刚刚承担了一个新客户的网站的责任。 操作系统是Linux。 他们在文档根目录下有一个cgi-bin目录。
我正在查看我的error.log脚本的问题,并发现了一些尝试访问未使用的Perl脚本。 我已经删除了整个cgi-bin目录。
问题:
我在哪里可以findLinux VPS上的suexec日志? 它不在/ var / log / httpd / suexec_log中
攻击者如何获得cgi-bin的目录列表,假设权限被正确设置?
任何想进一步的行动,现在的cgi斌已被删除?
[Mon Nov 21 01:15:08 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 01:15:08 2011] [error] [client 66.249.68.193] Premature end of script headers: excel.pl [Mon Nov 21 01:32:30 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 01:32:30 2011] [error] [client 66.249.68.193] Premature end of script headers: forward.pl [Mon Nov 21 01:49:52 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 01:49:52 2011] [error] [client 66.249.68.193] Premature end of script headers: harvest.pl [Mon Nov 21 01:58:27 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 01:58:27 2011] [error] [client 66.249.68.193] Premature end of script headers: who.pl [Mon Nov 21 02:07:14 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 02:07:14 2011] [error] [client 66.249.68.193] Premature end of script headers: thousandwords.pl [Mon Nov 21 02:17:21 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 02:17:21 2011] [error] [client 66.249.68.193] Premature end of script headers: news.pl [Mon Nov 21 02:41:58 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 02:41:58 2011] [error] [client 66.249.68.193] Premature end of script headers: environment.pl [Mon Nov 21 02:52:14 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 02:52:14 2011] [error] [client 66.249.68.193] Premature end of script headers: xpdf.pl [Mon Nov 21 02:59:20 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 02:59:20 2011] [error] [client 66.249.68.193] Premature end of script headers: mail.pl [Mon Nov 21 02:59:47 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 02:59:47 2011] [error] [client 66.249.68.193] Premature end of script headers: score.pl [Mon Nov 21 03:16:42 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 03:16:42 2011] [error] [client 66.249.68.193] Premature end of script headers: pdfextract.pl [Mon Nov 21 03:16:54 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 03:16:54 2011] [error] [client 66.249.68.193] Premature end of script headers: surveysays.pl [Mon Nov 21 03:26:22 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 03:26:22 2011] [error] [client 66.249.68.193] Premature end of script headers: surveycookie.pl [Mon Nov 21 03:51:26 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 03:51:26 2011] [error] [client 66.249.68.193] Premature end of script headers: search.cgi [Mon Nov 21 04:08:48 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 04:08:48 2011] [error] [client 66.249.68.193] Premature end of script headers: shuffler.pl [Mon Nov 21 06:37:34 2011] [error] [client 66.249.68.193] suexec policy violation: see suexec log for more details [Mon Nov 21 06:37:34 2011] [error] [client 66.249.68.193] Premature end of script headers: tickerBN.pl [Mon Nov 21 06:56:58 2011] [error] [client 66.249.68.193] suexec failure: could not open log file [Mon Nov 21 06:56:58 2011] [error] [client 66.249.68.193] fopen: Permission denied [Mon Nov 21 06:56:58 2011] [error] [client 66.249.68.193] Premature end of script headers: weatherFind.pl [Mon Nov 21 08:14:37 2011] [error] [client 66.249.68.193] suexec failure: could not open log file [Mon Nov 21 08:14:37 2011] [error] [client 66.249.68.193] fopen: Permission denied [Mon Nov 21 08:14:37 2011] [error] [client 66.249.68.193] Premature end of script hea
什么味道的Linux? 尝试/var/log/apache2/suexec.log,但看起来像suexec(Apache)没有写入日志文件的权限。 似乎是一个机器人寻找脆弱的脚本。