🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.pl.comp.os.linux.debian
Article #29857

Apache i grsec

#29857
From: jacki
Date: Fri, 10 May 2013 08:19
58 lines
2700 bytes
Hej,

Od kilku dni mam pewien problem, w logach pojawia się coś takiego:

May 10 07:12:18 x kernel: [11163676.048754] ps[27128]: segfault at 
40ed04 ip 00000000004059d2 sp 000070cd14ae1df8 error 7 in ps 
(deleted)[400000+2b000]
May 10 07:12:18 x kernel: [11163676.048865] grsec: bruteforce prevention 
initiated against uid 33, banning for 15 minutes

uid 33 to www-data

Po tym apache2 umiera i trzeba go zrestartować. Nie mam pojęcia gdzie 
zacząć szukać rozwiązania.

# dpkg -l|grep apache|awk '{print $2" "$3}'
apache2 2.2.16-6+squeeze11
apache2-doc 2.2.22-13
apache2-mpm-prefork 2.2.16-6+squeeze11
apache2-prefork-dev 2.2.16-6+squeeze11
apache2-suexec 2.2.22-13
apache2-utils 2.2.16-6+squeeze11
apache2.2-bin 2.2.16-6+squeeze11
apache2.2-common 2.2.16-6+squeeze11
libapache2-mod-evasive 1.10.1-1
libapache2-mod-perl2 2.0.4-7+squeeze1
libapache2-mod-php5 5.3.3-7+squeeze15
libapache2-mod-suphp 0.7.1-3
libapache2-mod-wsgi 3.3-2
libapache2-reload-perl 0.12-1

# dpkg -l|grep php|awk '{print $2" "$3}'
libapache2-mod-php5 5.3.3-7+squeeze15
libapache2-mod-suphp 0.7.1-3
php-pear 5.3.3-7+squeeze15
php5-cgi 5.3.3-7+squeeze15
php5-cli 5.3.3-7+squeeze15
php5-common 5.3.3-7+squeeze15
php5-curl 5.3.3-7+squeeze15
php5-dev 5.3.3-7+squeeze15
php5-gd 5.3.3-7+squeeze15
php5-mcrypt 5.3.3-7+squeeze15
php5-mysql 5.3.3-7+squeeze15
php5-sqlite 5.3.3-7+squeeze15
php5-suhosin 0.9.32.1-1
phpmyadmin 4:3.4.11.1-2
suphp-common 0.7.1-3

/var/log/apache2# cat *.access.log|grep -e "07:12:17"
83.5.24.164 - - [10/May/2013:07:12:17 +0200] "GET /favicon.ico HTTP/1.1" 
404 511
/var/log/apache2# cat *.access.log|grep -e "07:12:18"
/var/log/apache2# cat *.error.log|grep -e "07:12:17"
[Fri May 10 07:12:17 2013] [error] [client 83.5.24.164] File does not 
exist: /home/dhn/public_html/favicon.ico
/var/log/apache2# cat *.error.log|grep -e "07:12:18"

Ma ktoś jakiś pomysł cóż to może się dziać?
Technical Details
Message-ID: <kmiaj2$voh$1@news.task.gda.pl>
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!agh.edu.pl!news.agh.edu.pl!news.cyf-kr.edu.pl!news.task.gda.pl!not-for-mail

Show Full Headers
Complete Article Headers
Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!agh.edu.pl!news.agh.edu.pl!news.cyf-kr.edu.pl!news.task.gda.pl!not-for-mail
From: jacki <collector@idealan.pl>
Newsgroups: alt.pl.comp.os.linux.debian
Subject: Apache i grsec
Date: Fri, 10 May 2013 10:19:49 +0200
Organization: CI TASK http://www.task.gda.pl/
Lines: 59
Message-ID: <kmiaj2$voh$1@news.task.gda.pl>
NNTP-Posting-Host: siec.idealan.pl
Mime-Version: 1.0
X-Trace: news.task.gda.pl 1368173986 32529 178.212.144.2 (10 May 2013 08:19:46 GMT)
X-Complaints-To: abuse@news.task.gda.pl
NNTP-Posting-Date: Fri, 10 May 2013 08:19:46 +0000 (UTC)
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:17.0) Gecko/20130328 Thunderbird/17.0.5
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit