httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Chuck Lidderdale <chu...@blackforest-co.com>
Subject Re: [users@httpd] Signs of Apache Web Server been hacked
Date Mon, 11 Nov 2013 15:19:03 GMT
Normally I just lurk hoping to pick up a thing or two but today I'd like 
to comment.  Way back when I ran across a script called "COPS" that runs 
daily.  It was/is a collection of scripts, one of which is:

    find / | sum > thisrun
    diff thisrun lastrun | report
    mv thisrun lastrun

run = daily, weekly, hourly... your pick.  If any files get changed 
you're told.
Also my htaccess contains a lot of "deny from a.b.c.d" (and several 
n.0.0.0/8).

Chuck


>     You could start by seeing if any of the files have been changed
>     recently (OS-specific; are you running Linux?) or something has been
>     uploaded (if it is still there).
>


Mime
View raw message