[Xitami] NIMDA filter

[Patrick L. Olson]

If you are running Linux this will block any attempt form the IP's from
accessing your site a little harsh but would work


Mike wrote:
> 
> The September 19 Linux Journal Weekly News Notes included the following
> script to block connections from Nimda-infected sites:
> 
> #!/bin/sh
> #
> # Block sites which originate Nimba queries from Apache server
> # Apache must be configured with HostnameLookups Off
> 
> LOGS=/var/log/httpd
> 
> cd $LOGS
> 
> grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
> awk '/system32\/cmd\.exe/ {sub(/[^:]*:/,"");print $1}' |
> sort -u |
> while read host
> do
> if ! fgrep $host /var/tmp/blocked >/dev/null
> then
> echo $host >>/var/tmp/blocked
> /sbin/ipchains -I input -s $host -j DENY -l
> fi
> done
> 
> Question:  Is there a way to configure xitami to similarly block
> connections from Nimda infected sites?  If so, would somebody mind doing a
> step-by-step explanation?
> 
> Thanks.
> 
> Mike

-- 
"On the side of the software box, in the 'System
Requirements' section, it said 'Requires Windows 95 or better'.
So I installed Linux."      -Anonymous
Running Linux 7.0, P100  56megs, Apache 1.3.20 --with php4.0.6,
Mysql, perl,