httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Chuck Lidderdale <>
Subject Re: [users@httpd] Signs of Apache Web Server been hacked
Date Mon, 11 Nov 2013 15:19:03 GMT
Normally I just lurk hoping to pick up a thing or two but today I'd like 
to comment.  Way back when I ran across a script called "COPS" that runs 
daily.  It was/is a collection of scripts, one of which is:

    find / | sum > thisrun
    diff thisrun lastrun | report
    mv thisrun lastrun

run = daily, weekly, hourly... your pick.  If any files get changed 
you're told.
Also my htaccess contains a lot of "deny from a.b.c.d" (and several 


>     You could start by seeing if any of the files have been changed
>     recently (OS-specific; are you running Linux?) or something has been
>     uploaded (if it is still there).

View raw message