Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (nike.apache.org: domain of bluethundr@gmail.com designates
 209.85.223.179 as permitted sender)
Subject: Re: w00tw00t.at.ISC.SANS.DFind not found
References: 
 <CAOZy0enmYXSvqGChqfxzvHm9PC=42b=hk4qRiwz+Oc2faJ2yCg@mail.gmail.com>
 <CAAwnuDv+03R4rt6SDykYPzmJ74FAAJw4C0q7S2d2PJxOVC3=QQ@mail.gmail.com>
From: Tim Dunphy <bluethundr@gmail.com>
Content-Type: multipart/alternative;
	boundary=Apple-Mail-D419EEDF-C4E3-45B8-A59F-AEC216922009
In-Reply-To: 
 <CAAwnuDv+03R4rt6SDykYPzmJ74FAAJw4C0q7S2d2PJxOVC3=QQ@mail.gmail.com>
Message-Id: <ECF94771-933C-4C5C-A37A-D5E517A1A7B1@gmail.com>
Date: Sun, 8 Sep 2013 07:40:57 -0400
To: "user@cassandra.apache.org" <user@cassandra.apache.org>
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (1.0)


--Apple-Mail-D419EEDF-C4E3-45B8-A59F-AEC216922009
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Richard,

Good advice. Thank you! I'll work on tuning IP tables so that only my other C=
assandra nodes can connect to mx4j. Good thing I caught this, I was just mak=
ing sure JNA was working when I saw this!

Sent from my iPhone

On Sep 8, 2013, at 5:40 AM, Richard Low <richard@wentnet.com> wrote:

> On 8 September 2013 02:55, Tim Dunphy <bluethundr@gmail.com> wrote:
>> Hey all,
>>=20
>>  I'm seeing this exception in my cassandra logs:
>>=20
>> Exception during http request
>> mx4j.tools.adaptor.http.HttpException: file mx4j/tools/adaptor/http/xsl/w=
00tw00t.at.ISC.SANS.DFind:) not found
>>         at mx4j.tools.adaptor.http.XSLTProcessor.notFoundElement(XSLTProc=
essor.java:314)
>>         at mx4j.tools.adaptor.http.HttpAdaptor.findUnknownElement(HttpAda=
ptor.java:800)
>>         at mx4j.tools.adaptor.http.HttpAdaptor$HttpClient.run(HttpAdaptor=
.java:976)
>>=20
>> Do I need to be concerned about the security of this server? How can I co=
rrect/eliminate this error message? I've just upgraded to Cassandra 2.0 ,and=
 this is the first time I've seen this error.=20
>=20
> There is a web vulnerability scanner that does "GET /w00tw00t.at.ISC.SANS.=
DFind:)" on anything it thinks is HTTP.  This probably means your mx4j port i=
s open to the public which is a security issue.  This means anyone can e.g. d=
elete all your data or stop your Cassandra nodes.  You should make sure that=
 all your Cassandra ports (at least) are firewalled so only you and other no=
des can connect.
>=20
> Richard.

--Apple-Mail-D419EEDF-C4E3-45B8-A59F-AEC216922009
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: 7bit

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Richard,</div><div><br></div><div>Good advice. Thank you! I'll work on tuning IP tables so that only my other Cassandra nodes can connect to mx4j. Good thing I caught this, I was just making sure JNA was working when I saw this!<br><br>Sent from my iPhone</div><div><br>On Sep 8, 2013, at 5:40 AM, Richard Low &lt;<a href="mailto:richard@wentnet.com">richard@wentnet.com</a>&gt; wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">On 8 September 2013 02:55, Tim Dunphy <span dir="ltr">&lt;<a href="mailto:bluethundr@gmail.com" target="_blank">bluethundr@gmail.com</a>&gt;</span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">

<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hey all,<div><br></div><div>&nbsp;I'm seeing this exception in my cassandra logs:</div>

<div><br></div><div><div>Exception during http request</div><div>mx4j.tools.adaptor.http.HttpException: file mx4j/tools/adaptor/http/xsl/w00tw00t.at.ISC.SANS.DFind:) not found</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; at mx4j.tools.adaptor.http.XSLTProcessor.notFoundElement(XSLTProcessor.java:314)</div><div>&nbsp; &nbsp; &nbsp; &nbsp; at mx4j.tools.adaptor.http.HttpAdaptor.findUnknownElement(HttpAdaptor.java:800)</div><div>&nbsp; &nbsp; &nbsp; &nbsp; at mx4j.tools.adaptor.http.HttpAdaptor$HttpClient.run(HttpAdaptor.java:976)</div>


<div><br></div><div>Do I need to be concerned about the security of this server? How can I correct/eliminate this error message? I've just upgraded to Cassandra 2.0 ,and this is the first time I've seen this error.&nbsp;</div>

</div></div></blockquote><br>There is a web vulnerability scanner that does "GET /w00tw00t.at.ISC.SANS.DFind:)" on anything it thinks is HTTP. &nbsp;This probably means your mx4j port is open to the public which is a security issue. &nbsp;This means anyone can e.g. delete all your data or stop your Cassandra nodes. &nbsp;You should make sure that all your Cassandra ports (at least) are firewalled so only you and other nodes can connect.</div>

<div class="gmail_quote"><br></div><div class="gmail_quote">Richard.</div></div></div>
</div></blockquote></body></html>
--Apple-Mail-D419EEDF-C4E3-45B8-A59F-AEC216922009--