Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few questions about these sections:

  1. Is apache or logwatch the one picking up and reporting on the known hacks? Which program actually knows that it is a known hack? Is there a certain location or reference point that one of these programs is using for their list of known attacks?
  2. Is logwatch able to report on whether an attack was successful or not, or do I need a separate piece of software for picking that up?
  3. What exactly does it mean when logwatch reports that x amount of sites probed the server? Is it a port scan? Vulnerability scan? Fingerprinting? Is apache the one reporting this to the log files or is logwatch analyzing the log files and figuring it out?
share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted
  1. It is logwatch which knows about some well-known hacks. These are hard-coded into logwatch. Check the file services/http for the line which starts with my @exploits. You will see these are just some very simple patterns which are detected.
  2. If the webserver doesn't respond with an error status, logwatch considers the hack successful.
  3. This is similar to a portscan - somebody or some piece of software checks if your webserver is vulnerable.

Personally, I wouldn't pay too much attention to that report.

share|improve this answer
    
Thanks for the info. Since you said logwatch can consider attacks as successful if there was no error response returned, will the section say something different like "x amount of successful attacks" if they were completed or will it always say "attempts to use known hacks..."? –  Aaron May 9 '12 at 21:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.