News Group Posts

nimda virus web log apache denial of service dos

unixware security

From: steve.overy@unisys.com (steve overy)
Newsgroups: comp.unix.sco.misc
Subject: Re: Help.. I think the NIMDA virus is knocking out my SCO Web server.
Date: 26 Sep 2001 05:09:07 -0700
Message-ID: <55de11a6.0109260409.12b833ca@posting.google.com> 
References: <00b001c14548$39a41120$06000059@ctorrisi>
<55de11a6.0109250024.44f5e644@posting.google.com>
<3bb1774d.18780601@news.sf.sbcglobal.net> 

mschalit@pacbell.net (Matt Schalit) wrote in message news:<3bb1774d.18780601@news.sf.sbcglobal.net>...
> On 25 Sep 2001 01:24:41 -0700, steve.overy@unisys.com (steve overy) wrote:
> 
> >Con Torrisi <scoadmin@bretts.com.au> wrote in message news:<00b001c14548$39a41120$06000059@ctorrisi>...
> >> Hi everyone,
> >> 
> >> Ever since the NIMDA virus hit our web server has been stopping. Its a SCO
> >> 5.0.2 with Netscape 1.12. Everything else on the system is working fine
> >> (e.g. mail telnet etc) but it wont serve web pages. Doing a "restart" on the
> >> web server component gets it going again for a short time but it will soon
> >> stop.
> >> 
> >> I don't think it has the virus but other infected Microsoft machines are
> >> attacking it and I think thats doing the damage.
> >> 
> >> Any help greatly appreciated.
> >> 
> >> Con
> >> 
> >
> >yes, we've seen problems on our well patched (inc security patches)
> >lab uw711 - the web server (netscape) was fine but the first symptom
> >was basename failing, cron jobs not running - cron log showed jobs
> >failing rc=1, looking at the /var/adm/sa showed last data 17 sept -
> >ring any bells? turned out even the console login was failing,
> >shutdown not working. Terminated the system with extreme prejudice &
> >rebooted clean. maybe some dynamic libs got corrupt?
> >
> >steve
> 
> 
> There used to be a discussion on the www.sco.com/security/
> site for UnixWare 7.1.1 that described a defense against
> denial of service.
> 
> It was a tunable parameter or the like, which is set to 0
> by default (unlimited) but can be set to, let's say, 300.
> After 300 requests for a service, the additional requests
> would be discarded on an intelligent basis like a modified
> first-in-first-out.
> 
> Do you have that enabled, Steve?  
> 
> I can't find the reference... www.sco.com/security/ is 
> offline, and not replicated the same way on Caldera's site.
> I didn't copy it into the FAQ because I didn't want to 
> plagarize them, and now it's gone.
> 
> Matt

Matt,
    thats news to me - so I dont have the tunable... I never even
noted a discussion group under the security pages - maybe I wasn't
looking properly.
Whilst I'm associating this with nimda I'm not convinced... I assumed
denial of service was due to message floods not that it corrupted the
os! (also I see nothing in the advisories that suggests nimda attacks
unix)

steve
 

Comments?

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.