Article View: alt.pl.comp.os.linux.debian
Article #29857Apache i grsec
From: jacki
Date: Fri, 10 May 2013 08:19
Date: Fri, 10 May 2013 08:19
58 lines
2700 bytes
2700 bytes
Hej,
Od kilku dni mam pewien problem, w logach pojawia się coś takiego:
May 10 07:12:18 x kernel: [11163676.048754] ps[27128]: segfault at
40ed04 ip 00000000004059d2 sp 000070cd14ae1df8 error 7 in ps
(deleted)[400000+2b000]
May 10 07:12:18 x kernel: [11163676.048865] grsec: bruteforce prevention
initiated against uid 33, banning for 15 minutes
uid 33 to www-data
Po tym apache2 umiera i trzeba go zrestartować. Nie mam pojęcia gdzie
zacząć szukać rozwiązania.
# dpkg -l|grep apache|awk '{print $2" "$3}'
apache2 2.2.16-6+squeeze11
apache2-doc 2.2.22-13
apache2-mpm-prefork 2.2.16-6+squeeze11
apache2-prefork-dev 2.2.16-6+squeeze11
apache2-suexec 2.2.22-13
apache2-utils 2.2.16-6+squeeze11
apache2.2-bin 2.2.16-6+squeeze11
apache2.2-common 2.2.16-6+squeeze11
libapache2-mod-evasive 1.10.1-1
libapache2-mod-perl2 2.0.4-7+squeeze1
libapache2-mod-php5 5.3.3-7+squeeze15
libapache2-mod-suphp 0.7.1-3
libapache2-mod-wsgi 3.3-2
libapache2-reload-perl 0.12-1
# dpkg -l|grep php|awk '{print $2" "$3}'
libapache2-mod-php5 5.3.3-7+squeeze15
libapache2-mod-suphp 0.7.1-3
php-pear 5.3.3-7+squeeze15
php5-cgi 5.3.3-7+squeeze15
php5-cli 5.3.3-7+squeeze15
php5-common 5.3.3-7+squeeze15
php5-curl 5.3.3-7+squeeze15
php5-dev 5.3.3-7+squeeze15
php5-gd 5.3.3-7+squeeze15
php5-mcrypt 5.3.3-7+squeeze15
php5-mysql 5.3.3-7+squeeze15
php5-sqlite 5.3.3-7+squeeze15
php5-suhosin 0.9.32.1-1
phpmyadmin 4:3.4.11.1-2
suphp-common 0.7.1-3
/var/log/apache2# cat *.access.log|grep -e "07:12:17"
83.5.24.164 - - [10/May/2013:07:12:17 +0200] "GET /favicon.ico HTTP/1.1"
404 511
/var/log/apache2# cat *.access.log|grep -e "07:12:18"
/var/log/apache2# cat *.error.log|grep -e "07:12:17"
[Fri May 10 07:12:17 2013] [error] [client 83.5.24.164] File does not
exist: /home/dhn/public_html/favicon.ico
/var/log/apache2# cat *.error.log|grep -e "07:12:18"
Ma ktoś jakiś pomysł cóż to może się dziać?
Technical Details
Message-ID:
<kmiaj2$voh$1@news.task.gda.pl>Path:
mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!agh.edu.pl!news.agh.edu.pl!news.cyf-kr.edu.pl!news.task.gda.pl!not-for-mailShow Full Headers
Complete Article Headers
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!agh.edu.pl!news.agh.edu.pl!news.cyf-kr.edu.pl!news.task.gda.pl!not-for-mail From: jacki <collector@idealan.pl> Newsgroups: alt.pl.comp.os.linux.debian Subject: Apache i grsec Date: Fri, 10 May 2013 10:19:49 +0200 Organization: CI TASK http://www.task.gda.pl/ Lines: 59 Message-ID: <kmiaj2$voh$1@news.task.gda.pl> NNTP-Posting-Host: siec.idealan.pl Mime-Version: 1.0 X-Trace: news.task.gda.pl 1368173986 32529 178.212.144.2 (10 May 2013 08:19:46 GMT) X-Complaints-To: abuse@news.task.gda.pl NNTP-Posting-Date: Fri, 10 May 2013 08:19:46 +0000 (UTC) User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:17.0) Gecko/20130328 Thunderbird/17.0.5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit