Apache

This is here for reminders sake really. Second time in a week I've needed to use a perl sort construct and forgotten how it 'works'. Gist is to search for a certain field (user agent/robot) on each line from STDIN (a httpd access logfile), keep track of how many of each entry (robot) we find and finally print out the count (hits) for each entry (robot).

Makes more sense when you execute the script perhaps. Or not. Whatever, it's just a reminder for the next time I need to use the sort perlfunc on a hash. :P

Have been seeing quite a bit of comment spam recently on this weblog, mainly pimping online pharmacies. Needless to say this is not wanted.

After the fourth lot of spam in not that many days I've added a few lines to the mod_security section in my httpd.conf file to stop apache from allowing access if the POST payload contains certain keywords:



You get the gist, adding the keywords would freeze me out so won't bother with that :P

Before I considered mod_security though I was wondering how a spamassassin plugin might work with Serendipity - a plugin that would forward comments to a spamd daemon for spam checking before accepting the comment. Not too sure how spamd handles data that doesn't contain mail headers, I guess it should still parse it ok and return a score. No doubt this won't get pursued any further seeing as this mod_security fix should do the trick.

This is by no means a new attempt to exploit a vulnerability in a PHP web application, but since I started using snort as a full time intrusion detection system I've picked up countless attempts to exploit a vulnerability in an online PHP photo gallery called My_ eGallery. The annoying thing about this is that I've never had this gallery system installed on any of the sites I maintain - particularly the one that keeps getting hit - but they continue to try their exploits. Read on for more...

Ok, I'm really bored now. Some morons have been trying to exploit a hole in an online PHP gallery system called E_Gallery for weeks now. The thing is I don't have and never have had E_Gallery on my system - at least not in the location they're trying to 'exploit'.

This really pisses me off, why can't people bother to check whether the thing they're trying to exploit actually exists on the system they're trying to exploit before wasting bandwidth trying to exploit it??? Bloody idiot script kiddies.

Enough's enough, I've just set up this .htaccess file now to redirect them to the NSA kiddies page, let them try and crack something worth cracking:



I'll write something up about the actual exploit attempts in a separate article.

UPDATE:
Ok this was not a good idea, I'm redirecting hits to the URI to somewhere more interesting (like the location of the backdoor servers they're trying to install in the first place :P).

Here's a small teaser the solution to which is really obvious with the benefit of hindsight.

I needed to make all the files within a certain directory be served as plain text by Apache, regardless of their extension. The solution was to use the following in the httpd.conf file:



Specifically I had a directory which contained a lot of perl scripts all ending in the .pl extension and I didn't want them to be treated as executable files - ie I wanted the contents of the files to be visible in a browser to display the source code to users. Adding the above config lines did the trick.

The use of handlers in apache is covered here:

http://httpd.apache.org/docs/handler.html