[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [suse-security] Strange entry in Apache log
I'm no expert on this so take my comments with a pound of salt. It looks
to me like they tried to use your server to issue an smtp connect with
the earthlink mail server, perhaps to send some spam and cover their
tracks? I grep'ed through my webservers logs for "CONNECT" and came up
empty, looks a little fishy to me.
Keith Roberts wrote:
Can anyone tell what the following apache logs are?
The last line looks like they managed to connect to port 25.
Or did someone get my machine to connect to another servers
184.108.40.206 - - [27/Feb/2004:16:00:48 +0000]
"\x04\x01" 200 0 "-" "-"
220.127.116.11 - - [27/Feb/2004:16:01:40 +0000]
"\x05\x01" 200 0 "-" "-"
18.104.22.168 - - [27/Feb/2004:16:01:51 +0000]
"CONNECT 22.214.171.124:25 HTTP/1.1" 200 5664 "-" "-"
I have just been to grc.com, and my SMTP port is stealthed.
Here is a listing of netstat
keith@myserver:~> netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:printer *:* LISTEN
tcp 0 0 *:www-http *:* LISTEN
tcp 0 0 *:afs3-fileserver *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
Anyone have any ideas?
Kind Regards - Keith Roberts
Check the headers for your unsubscription address
For additional commands, e-mail: suse-security-help@xxxxxxxx
Security-related bug reports go to security@xxxxxxx, not here