Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -2 down vote favorite

Whereas I didn't do anything on my dedicated server today, I realized that I couldn't PING it, the site was unreachable. So I checked the logs:

In about several hours appeared 153 000 lines of:

[Sat Nov 24 23:24:18.318257 2012] [authz_core:debug] [pid 21841:tid 140204006696704] mod_authz_core.c(802): [client 80.8.82.242:62269] AH01626: authorization result of Require all granted: granted, referer: referer_url
[Sat Nov 24 23:24:18.318289 2012] [authz_core:debug] [pid 21841:tid 140204006696704] mod_authz_core.c(802): [client 80.8.82.242:62269] AH01626: authorization result of <RequireAny>: granted, referer: referer_url
[Sat Nov 24 23:24:19.850212 2012] [authz_core:debug] [pid 21841:tid 140203989911296] mod_authz_core.c(802): [client 80.8.82.242:62270] AH01626: authorization result of Require all granted: granted, referer: referer_url

Those log entries just appeared, even though I didn't do anything. In fact I show the logs at DEBUG level, before I had ever had these messages, now it appears every time.

Could someone explain why this has happened? Have I been hacked?

share|improve this question
1  
The log messages are from November 24. This seems way before your server was unreachable, right? And what do tools like unhide (man unhide; and you may have to install it) find? BTW, with debug messages, your logs can fill up fast. – Halfgaar Dec 31 '12 at 8:31
Oh you are totally right... BTW, what can this be ? have you got any idea ? – Alen Castry Dec 31 '12 at 8:53
i'm juste confuse for not having realised this... it's a production server in fact.. i hadn't an eye in the logs until now... as all the monitoring tools are installed and didn't told me anything... – Alen Castry Dec 31 '12 at 8:56

closed as not a real question by mdpc, John Gardeniers, Brent Pabst, rnxrx, Tom O'Connor Jan 1 at 2:27

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 1 down vote

This seems to me as normal log lines (for a debug level! Note that this is the most verbose level of logging) for access being granted to users. Do you have one or more password protected directories in your website? And is it possible that these directories were accessed 153000 times in the given time span?

share|improve this answer
I currently don't do any authentification... As i make a grep in the configuration folders, it appears that the only files who deals with auth are : conf/extra/httpd-dav.conf conf/extra/httpd-ssl.conf: conf/extra/httpd-userdir.conf I just don't use authenfication in my actual configuration... – Alen Castry Dec 31 '12 at 9:15
And you're the only one using it? And there's also no .htaccess file anywhere with any authorization configured? – bartlaarhoven Dec 31 '12 at 9:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.