Am Mo, den 30.01.2006 schrieb Adriano Frare um 19:17: > I use Centos 4.2 with all service pack installed. I verified traffic on > link WEB and I see port TCP 80 with many traffic. > > I accessed lod /var/log/httpd/access_log and show below. > > ca.com/members/index.php HTTP/1.0" 401 - > "http://members.sapphicerotica.com/members/index.php" "Mozilla/5.0 ( > compatible; MSIE 5.01; Windows XP; NetCaptor )" > 68.119.110.138 - - [30/Jan/2006:15:08:08 -0200] "GET > http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=NsyncAngel9&passwd=xxxx > HTTP/1.0" 200 9794 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET > http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=CoolPimP2&passwd=xxxx > HTTP/1.0" 200 9786 "-" "-" > 80.144.212.33 - - [30/Jan/2006:15:08:09 -0200] "GET > http://www.995members.com/members/ HTTP/1.0" 401 472 > "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; > DigiExt )" > 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET > http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool19999&passwd=xxxx > HTTP/1.0" 200 9786 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:12 -0200] "GET > http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=COOL699&passwd=xxxx > HTTP/1.0" 200 9786 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:13 -0200] "GET > http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=COOL696&passwd=xxxx > HTTP/1.0" 200 9786 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:14 -0200] "GET > http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool1875&passwd=xxxx > HTTP/1.0" 200 9786 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:16 -0200] "GET > http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool69_&passwd=xxxx > HTTP/1.0" 999 4445 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:17 -0200] "GET > http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool6665&passwd=xxxx > HTTP/1.0" 999 4445 "-" "-" > 68.119.110.138 - - [30/Jan/2006:15:08:18 -0200] "GET > http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cooldrugs7&passwd=xxxx > HTTP/1.0" 999 4445 "-" "-" > 82.39.175.52 - - [30/Jan/2006:15:08:35 -0200] "GET > http://l1.login.dcn.yahoo.com/config/login?.redir_from=PROFILES?&.tries=1&.src=jpg&.last=&promo=&.intl=us&.bypass=&.partner=&.chkP=Y&.done=http://jpager.yahoo.com/jpager/pager2.shtml&login=big_b_mt_biker&passwd=123456 > HTTP/1.0" 502 961 "-" "-" > 80.144.212.33 - - [30/Jan/2006:15:08:43 -0200] "GET > http://www.995members.com/members/ HTTP/1.0" 401 472 > "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; > DigiExt )" > 12.206.3.132 - - [30/Jan/2006:15:08:46 -0200] "GET > http://us.a1.yimg.com/login.bjs.yahoo.com/config/login?login=big_g_&passwd=321liftoff > HTTP/1.0" 200 4440 "http://www.yahoo.com/" "-" > 84.109.4.111 - - [30/Jan/2006:15:08:51 -0200] "CONNECT login.icq.com:443 > HTTP/1.0" 200 - "-" "-" > > > > I guess that hacker is using my SERVR APACHE to PROXY. Correct. The log provided show that. Looks like your host is already known to a crowd of misusers or the one who found you is already using several hosts to do his actions (see the originating IPs). > Please, I need help urgent. What do you expect? We don't know your Apache setup. Go through your httpd.conf and included configuration files and deactivate proxying - or at least make it secure if you need it for specific tasks. > I stoped service HTTPD because it. Good. > Adriano Alexander -- Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773 legal statement: http://www.uni-x.org/legal.html Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp Serendipity 18:21:38 up 56 days, 22:58, load average: 0.16, 0.16, 0.11 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: Dies ist ein digital signierter Nachrichtenteil URL: <http://lists.centos.org/pipermail/centos/attachments/20060130/7905f069/attachment-0004.sig>