Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whereas I didn't do anything on my dedicated server today, I realized that I couldn't PING it, the site was unreachable. So I checked the logs:

In about several hours appeared 153 000 lines of:

[Sat Nov 24 23:24:18.318257 2012] [authz_core:debug] [pid 21841:tid 140204006696704] mod_authz_core.c(802): [client] AH01626: authorization result of Require all granted: granted, referer: referer_url
[Sat Nov 24 23:24:18.318289 2012] [authz_core:debug] [pid 21841:tid 140204006696704] mod_authz_core.c(802): [client] AH01626: authorization result of <RequireAny>: granted, referer: referer_url
[Sat Nov 24 23:24:19.850212 2012] [authz_core:debug] [pid 21841:tid 140203989911296] mod_authz_core.c(802): [client] AH01626: authorization result of Require all granted: granted, referer: referer_url

Those log entries just appeared, even though I didn't do anything. In fact I show the logs at DEBUG level, before I had ever had these messages, now it appears every time.

Could someone explain why this has happened? Have I been hacked?

share|improve this question

closed as not a real question by mdpc, John Gardeniers, Brent Pabst, rnxrx, Tom O'Connor Jan 1 '13 at 2:27

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

The log messages are from November 24. This seems way before your server was unreachable, right? And what do tools like unhide (man unhide; and you may have to install it) find? BTW, with debug messages, your logs can fill up fast. – Halfgaar Dec 31 '12 at 8:31
Oh you are totally right... BTW, what can this be ? have you got any idea ? – Alen Castry Dec 31 '12 at 8:53
i'm juste confuse for not having realised this... it's a production server in fact.. i hadn't an eye in the logs until now... as all the monitoring tools are installed and didn't told me anything... – Alen Castry Dec 31 '12 at 8:56

This seems to me as normal log lines (for a debug level! Note that this is the most verbose level of logging) for access being granted to users. Do you have one or more password protected directories in your website? And is it possible that these directories were accessed 153000 times in the given time span?

share|improve this answer
I currently don't do any authentification... As i make a grep in the configuration folders, it appears that the only files who deals with auth are : conf/extra/httpd-dav.conf conf/extra/httpd-ssl.conf: conf/extra/httpd-userdir.conf I just don't use authenfication in my actual configuration... – Alen Castry Dec 31 '12 at 9:15
And you're the only one using it? And there's also no .htaccess file anywhere with any authorization configured? – bartlaarhoven Dec 31 '12 at 9:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.