Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was looking at my homemade server running apache 2.2.10 on it and this is what I saw:

**.**.**.** - - [10/Nov/2010:07:05:14 +0200] ">\x03\xb6@\x1b\xbdg\x9e\xe9a)\x1a\xd8\x10U\x0f \xd2\xa4zj\x02q\xd9\xa8[\xbfy/" 400 226
**.**.**.** - - [10/Nov/2010:07:05:16 +0200] "\x1c \x10\x8f&" 400 226
**.**.**.** - - [09/Nov/2010:15:55:00 +0200] "\x1e\xcf" 200 654
**.**.**.** - - [06/Nov/2010:04:36:07 +0200] "\xce\x14\x1c`n\xeb\x8b)x\xee0}\xcbr\x88\xb9lE\x95\xd5\xd3E\x82\x9b\xe0\xb5w\xd2&\xa2>e\xdcn;\x1f\xd1\xdb\xa3" 200 654
**.**.**.** - - [08/Nov/2010:22:28:46 +0200] "\xaa\xc7P\x19h\x80\x96\x03\xd9<\x93\x8e3\x92\xb4\xf5B6;V\xb3\x9f=6s\xf8\xad\x0f\xa2^\xde/\xf5\x92\x95\x8d" 200 654
**.**.**.** - - [30/Oct/2010:03:24:39 +0300] "\x95\xdb\xdb\"\xac#\xac?\xcfQ\v(\x1c\x13\xfb\x8b\xfdq(<\xe6\x12\xff$eY1\xc9@l\x95\xbfe\x15\x84\r\r\xa1\xf1[" 400 226

There are similar logs all over the place.
Most probably someone or a bot is trying to find and exploit or a backdoor.

My question here is how can I read what's behind that code and how can I prevent such codes from being executed? Also can you apache gurus share your experience with apache attacks and what's the best way to protect it?

Thanks in advance for any help,
The Devil

share|improve this question

1 Answer 1

So it looks like some type overflow attack at first glance.

It my systems, i regulary use an iDS,IPS (intrusion detection/protection system)

Attacks like this are usually mitagated by a good ruleset(similiar to antivirus).

It filters the traffic in realtime and checks for matches, finally if matched performs the specified operation (e.g DROP)

A suggestion of software would be snort, which is open source and maintains a comprehensive ruleset.

Keep in mind other technogies like rate limiting, and log scanning to catch on to foul play. However prevention is better than reaction, i would go with Snort :)

Hope this helps

share|improve this answer
1  
Yep.. I also think that prevention is better than reaction. My firewall doesn't allow no other port than 80,443 and 60. The only way someone could break in is via apache or bind. I'll try what you've written and I'll give a feedback in a couple of days :) Thank you! –  tftd Nov 14 '10 at 5:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.