Click to See Complete Forum and Search --> : Help making sense out of access and error log


mhlarsen9237
11-03-2002, 03:11 AM
I'm running apache 1.3.26. I was looking at my error and access logs and found this

access log stuff

adsl-63-204-174-86.dsl.lsan03.pacbell.net - - [02/Nov/2002:16:42:20 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 276

adsl-63-204-174-86.dsl.lsan03.pacbell.net - - [02/Nov/2002:16:42:19 -0700] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 297

error log stuff

[Sun Nov 3 00:31:45 2002] [error] [client 67.40.137.17] File does not
exist: /usr/local/apache/htdocs/d/winnt/system32/cmd.exe

[Sun Nov 3 00:31:47 2002] [error] [client 67.40.137.17] File does not exist:/usr/local/apache/htdocs/msadc/..%5c../..%5c../..%5c/..?^\../..?^\../..?^\../winnt/system32/cmd.exe

This stuff has been showing up for a few days now and I was wondering what to make of it.
It seems to me that someone thinks I'm running an IIS server and is trying to access my machine.
I've been reading the apache manual and have log since done the things listed in there for security, but I'm a little nervous. Would upgrading to apache 2.? offer much?

Thanks,
Matthew

element-x
11-03-2002, 12:27 PM
I wouldn't worry about these specific bits in your access/error logs. They're aimed at IIS systems, of which, since you're running apache, don't effect you.

Upgrade to 1.3.27 (keep up with latest stable) if you're really worried about things.