Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

Looking thru my logs, I found this:$

(The log files are on that paste).

Question is, this guy began using "all requests allowed" which is...? (Explain it please?) and eventually was making requests from "" which means he's using my local system?

If anyone can explain this, or help prevent it, I'd like to know, and this would be highly appreciated.


PS: I've since blocked their IP, but what's stopping this from happening again?

share|improve this question

marked as duplicate by Tom O'Connor, Shane Madden, Scott Pack, mailq, ewwhite Oct 23 '11 at 20:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

A search on 'allrequestsallowed' yielded this:… – mqsoh Oct 23 '11 at 7:06
@mqs - Mmm, thanks, I read that already. But that site seems shady. The IP of the "Attacker" is from Russia, AND WHEN VIEWING it as a website, it asks for credentials (http// so, it's really got me thinking. – U4iK_HaZe Oct 23 '11 at 7:08
@U4iK_HaZe I believe it was some kind of adsl/cable modem/router asking for management password - this setup is quite common in Russia. – rvs Oct 23 '11 at 7:23
A cable modem running an Apache server? – the-wabbit Oct 23 '11 at 14:27
@synet - The server is going through a firewall, then through an outside proxy server. (Webservers through an Apache proxy to firewall then to the public). And since this morning, there are MANY more of these entries in the logs. – U4iK_HaZe Oct 23 '11 at 14:38

1 Answer 1

up vote 1 down vote accepted

Don't panic. As a general advice, before reading logs and trying to get some security-related meaning out of them, be sure to have a sufficiently thorough understanding of what it does mean. Otherwise you end up with a heart attack over too many "dangerously looking" log entries.

What you see is simply Internet background noise - someone trying to pick on your configuration for possible weaknesses. Such "attacks" are usually simply blind attempts to exploit configuration problems or implementation bugs, most of them without any effect. There is absolutely no way to prevent this.

The log entry you see in your original log paste is an entry which has been induced by your own system - most probably not on the behalf of the attacker but through your own actions.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.