Need some help on security

[Dan Pelleg]

Robert Watson <rwatson at freebsd.org> writes:

> On Sat, 10 Jan 2004, David Edwards wrote:
> 
> > Anyway, on to the question, lastnight, the server stopped responding
> > after someone tried to gain access to what looks to be web based
> > printing. I am not familiar with any firewall/IDS solutions and have
> > looked over Snort and IPFW today. I don't want to do IPFW because I
> > don't want to recompile a kernel that works and potentially lose
> > everything I have done so far. Here is a bit of the apache error_log
> > which shows the issue i am refering to: 
> > 
> > [Sat Jan 10 01:34:04 2004] [error] [client 211.233.89.189] File does not
> > exist: /usr/home/dbcenter/public_html/NULL.printer
> > [Sat Jan 10 01:34:04 2004] [error] [client 211.233.89.189] File does not
> > exist: /usr/local/apache/htdocs/NULL.printer
> 
> Well, these log entries are for attempted exploits of Microsoft's IIS, and
> shouldn't be a problem.  The error messages can safely be ignored.
> 

Agreed. They can also be sent in a complaint to the appropriate admin. See
the security/hunch port.

-- 

  Dan Pelleg