News Group Posts

nimda virus web log apache denial of service dos

unixware security

From: mschalit@pacbell.net (Matt Schalit)
Newsgroups: comp.unix.sco.misc
Subject: Re: Help.. I think the NIMDA virus is knocking out my SCO Web server.
Message-ID: <3bb1ebcf.2191856@news.sf.sbcglobal.net> 
References: <00b001c14548$39a41120$06000059@ctorrisi>
<55de11a6.0109250024.44f5e644@posting.google.com>
<3bb1774d.18780601@news.sf.sbcglobal.net>
<55de11a6.0109260409.12b833ca@posting.google.com> 
X-UserInfo1: [[PAPDCA[S@_R_DYFJK\_RDBUKXD@D@MGPW^OBPLAH[\RWYAKVUOPCW[ML\JXUCKVFDYZKBMSFX^OMSAFNTINTDDMVW[X\THOPXZRVOCJTUTPC\_JSBVX\KAOTBAJBVMZTYAKMNLDI_MFDSSOLXINH__FS^\WQGHGI^C@E[A_CF\AQLDQ\BTMPLDFNVUQ_VM
Date: Wed, 26 Sep 2001 15:00:20 GMT

On 26 Sep 2001 05:09:07 -0700, steve.overy@unisys.com (steve overy) wrote:

>mschalit@pacbell.net (Matt Schalit) wrote in message news:<3bb1774d.18780601@news.sf.sbcglobal.net>...
>> On 25 Sep 2001 01:24:41 -0700, steve.overy@unisys.com (steve overy) wrote:
>> 
>> >Con Torrisi <scoadmin@bretts.com.au> wrote in message news:<00b001c14548$39a41120$06000059@ctorrisi>...
>> >> Hi everyone,
>> >> 
>> >> Ever since the NIMDA virus hit our web server has been stopping. Its a SCO
>> >> 5.0.2 with Netscape 1.12. Everything else on the system is working fine
>> >> (e.g. mail telnet etc) but it wont serve web pages. Doing a "restart" on the
>> >> web server component gets it going again for a short time but it will soon
>> >> stop.
>> >> 
>> >> I don't think it has the virus but other infected Microsoft machines are
>> >> attacking it and I think thats doing the damage.
>> >> 
>> >> Any help greatly appreciated.
>> >> 
>> >> Con
>> >> 
>> >
>> >yes, we've seen problems on our well patched (inc security patches)
>> >lab uw711 - the web server (netscape) was fine but the first symptom
>> >was basename failing, cron jobs not running - cron log showed jobs
>> >failing rc=1, looking at the /var/adm/sa showed last data 17 sept -
>> >ring any bells? turned out even the console login was failing,
>> >shutdown not working. Terminated the system with extreme prejudice &
>> >rebooted clean. maybe some dynamic libs got corrupt?
>> >
>> >steve
>> 
>> 
>> There used to be a discussion on the www.sco.com/security/
>> site for UnixWare 7.1.1 that described a defense against
>> denial of service.
>> 
>> It was a tunable parameter or the like, which is set to 0
>> by default (unlimited) but can be set to, let's say, 300.
>> After 300 requests for a service, the additional requests
>> would be discarded on an intelligent basis like a modified
>> first-in-first-out.
>> 
>> Do you have that enabled, Steve?  
>> 
>> I can't find the reference... www.sco.com/security/ is 
>> offline, and not replicated the same way on Caldera's site.
>> I didn't copy it into the FAQ because I didn't want to 
>> plagarize them, and now it's gone.
>> 
>> Matt
>
>Matt,
>    thats news to me - so I dont have the tunable... I never even
>noted a discussion group under the security pages - maybe I wasn't
>looking properly.
>Whilst I'm associating this with nimda I'm not convinced... I assumed
>denial of service was due to message floods not that it corrupted the
>os! (also I see nothing in the advisories that suggests nimda attacks
>unix)
>
>steve

  Yea, I see what you mean.  We're talking about the same thing,
it's likely a flood problem rather than your web server being
affected.  So perhaps a network monitor on a promiscuous host
would help you determine the volume of requests your getting
and then you could set the syn flood tcp_q0limit parameter to
a value less than that on your SCO box.

  Luckily for us (heh, heh), Bela's still lurking, and sent
me a reply from Caldera on a different thread, but about this
problem, reminding me of the name and the url's:


|I _think_ what you're referring to is the SYN flood protection afforded
|by the parameter "tcp_q0limit".  It's described at:
|
|  http://docsrv.sco.com:1997/cgi-bin/man/man?inconfig+1Mtcp
|  http://docsrv.sco.com:1997/cgi-bin/man/man?listen+3sock
|  http://docsrv.sco.com:1997/SM_perform/_Networking_Parameters.html
|
|The machine(s) you're trying to protect should have these as
|inconfig(1Mtcp), listen(3sock), and
|http://localhost/SM_perform/_Networking_Parameters.html.
|
|Also look for the related parameter "tcp_initial_timeout".
|
|The OSR506 doc has a more complete discussion of the q0limit parameter
|vs. SYN floods:
|
|  http://osr5doc.ca.sco.com:457/NetAdminG/nwRs_SYNflood.html
|
|>Bela<

Cheers,
Matt 

 

Comments?

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.