I have been tracking down a bug which I have reduced to the following case. We have a web server running apache and it doesn't serve filenames including "/bin/sh" pattern outside of the campus in which the server is located (e.g. www.example.com/some/sub/folders/bin/show.html
. Maybe related is that the same url with https
in the beginning instead of http
works without a problem once you skip the certification error. It is difficult to change all such filenames in our application so I'm trying to fix this issue instead. How can I debug this any further?
Log file /etc/httpd/logs/access_log
shows an unrelated GET
request url for this filename. Other filenames show up as they are. I have checked configuration files under /etc/httpd/conf
and /etc/httpd/conf.d
but I couldn't see anything related, although I'm not familiar with these configuration files.
Apache version is as follows:
# httpd -v
Server version: Apache/2.0.52
Server built: Oct 29 2008 09:20:05
Any ideas?
EDIT
Log messages from inside the campus (response 304 for regular cached browser window and response 200 is for private non-cached browser window):
(ip addr) - - [27/Apr/2017:13:06:45 +0300] "GET /appserv/bin/sh.html HTTP/1.1" 304 - "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0"
(ip addr) - - [27/Apr/2017:13:06:54 +0300] "GET /appserv/bin/sh.html HTTP/1.1" 200 154 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0"
Log messages from outside of campus (tested with tor and various vps nodes):
(ip addr) - - [27/Apr/2017:13:08:08 +0300] "GET /cosbiom/component/option,com_extcalendar/Itemid,99999999/extmode,day/date,2031-02-04/ HTTP/1.1" 200 28936 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
access_log
entries for this url and other similar ones (not matching /bin/sh) look the same? If they both report success then I'm more confident that the problem lies outside the server. Could you add example log lines to the question?