someone sent this out on a list. gives a neat little way of dealing with the hits that an apache box is getting:
-----
PHP Code:
i got tired of seeing boxes hitting my servers with this code red
business so i did something about it....
first, i did this in the apache configuration outside of any virtual
hosts so it would affect every site i run:
Alias /default.ida /usr/local/apache/vdocs/sys/codered/default.ida
then i did this: AddType application/x-httpd-php .ida (again, outside
virtual hosts)
and then i made the default.ida file:
<?
echo $REMOTE_ADDR;
$msg = "CODE RED FROM $REMOTE_ADDR";
#mail("andy@m...","CODERED",$msg);
$fd = fopen("/usr/local/apache/vdocs/sys/codered/log","a");
fwrite($fd,"$REMOTE_ADDR\n");
fclose($fd);
echo "YOU SUCK! DOWNLOAD THE PATCH!!";
?>
so that i would have a log of every ip that has been hitting my box!
then i can make firewall rules to block them out completely or i can
contact their admins or isp's and have them shutdown.
here are the worst offenders since 09-11-2001:
# of times address
12 198.63.212.15
17 198.234.111.91
57 198.172.140.13
2050 198.172.66.246
2553 198.172.176.135
the last two are on a closely related network to the one i'm on which
is why i get hit so much.
anyhoo, if you want to keep track of who is pounding on your server
and might not even realize they are infected, this will do the trick.
i also wrote a short perl script to rotate the log:
#!/usr/bin/perl
$LOGFILE = "/usr/local/apache/vdocs/sys/codered/log";
$date = `date +'%m%d%Y%H%M'`;
chop $date;
print $date . "\n";
$NEWLOG = $LOGFILE . ".$date";
rename $LOGFILE, $NEWLOG || die "RENAME FAILED HORRIBLY $!\n";
open(FD,">$LOGFILE") || die "OPEN FAILED MISERABLY\n";
close(FD);
chown 99,99,$LOGFILE;
print "LOG ROTATED\n";
i hope this isn't too off topic, i thought some people might find it
useful. if you come up with any modifications, lemme know.
Andrew Watson
Reply With Quote
im getting just freakin FLODDED though.
Bookmarks