re; [Xitami] Most Requested Files

[Charles Schmidling]

Steve,

Don't forget the default.ida file request that has that gibberishly long
request.  I believe that is an attempt to stuff and overflow some buffer
(that appears fixed in latest Xitami).  Yeah!

Virtual Hosting maintains separate log files for each domain.  (Those
numerical archive things are bugging me though.).  "Access.log" now logs
only the base host.  Since the scanners only go at your WAN IP, it logs into
access.log and the world is a neater, cleaner place.

To be rid of these scans, I first tried to port forward port 80 to another
port on my router but what I wanted to filter just followed the forwarding
(duh!).

So I changed my base HTTP port to 1975.  This eliminates ALL scanners that
come in under my IP (search bots come in by domain).  At my DNS service
(ZoneEdit) I set up a ww2.thisdomain.com(or any extension) for each domain I
have and point it to my server.  In Web Forwarding, each main domain
(www.eachdomain.com and eachdomain.com) to http://ww2eachdomain.com:1975/.
Cloaking is not necessary since you don't really need to hide anything.

This really cleaned up everything.  If you VH, another entry for each ww2
domain must made.

What I want to know is how do we tell these people that their computer is
compromised.  Or retaliate.  The IPs I log appear to be simple users, some
even in my cluster.  Since most Broadband providers frown on serving, it's
not like I can report these incidents to my provider!

Still searching...

Charles


----- Original Message -----
From: "Steven L. Haas" <slhaas99@hotmail.com>
To: <xitami@lists.xitami.org>
Sent: Monday, February 02, 2004 7:16 AM
Subject: Re: re; [Xitami] Most Requested Files


> how?
>
> ----- Original Message -----
> From: "Go Bonkers" <gobonkers@hotmail.com>
> To: <xitami@lists.xitami.org>
> Sent: Monday, February 02, 2004 8:53 AM
> Subject: re; [Xitami] Most Requested Files
>
>
> > ~~~
> > "404 not found errors, but none of my links
> > are bad, so I don't understand what this could be caused by.  The only
> thing
> > I can track down is that the most commonly requested files are cmd.exe
and
> > httpodbc.dll"
> > ~
> > I've taken the approach of making a virtual host.cfg for my IP# and
> blocking
> > access to it.  Those worms still come through but now get logged into a
> > separate logfile - keeps my regular logfile much smaller and readable
and
> at
> > the same time keeps the kids scanning ip#'s and fiddling around away.
> > ~~~
> >
> > _________________________________________________________________
> > What are the 5 hot job markets for 2004? Click here to find out.
> >
>
http://msn.careerbuilder.com/Custom/MSN/CareerAdvice/WPI_WhereWillWeFindJobs
In2004.htm?siteid=CBMSN3006&sc_extcmp=JS_wi08_dec03_hotmail1
> >
> >
> > --
> > Xitami Users Mailing List -- For Xitami support
> > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> >
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami