Security Basics mailing list archives

Re: GET //awstats.pl? in apache logs


From: Konstantine <listclient () gmail com>
Date: Mon, 24 Oct 2005 22:47:43 +0100

On 10/24/05, S.A. Birl <sbirl () temple edu> wrote:

    <snip>
    Or, you could do what I did:
    Write your own PERL script to caputre the offending IP, write it
    out to an external blacklist (that Apache includes in it's httpd.conf);
    restart Apache and viola!  IP banned.

    <snip implementation>


I like this idea and I will probably use it, not for banning but
making a list of IPs making various requests. Thanks for providing the
example. I am not familiar with Perl so I have two questions relating
to your script if you don't mind. Thanks in advance.

Is there anyway a request is made as to $ENV{"REMOTE_ADDR"} to be
something other than expected form. i.e. a dotted quad IP?

system("/usr/bin/touch /usr/local/apache/nobody /restart"); # What is
this line doing?

Thanks again to everybody who replied to my original posting.
K.

Current thread: