Re: Denial of Service due to multiplication of httpd running

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 22 May 2012, William A. Rowe Jr. wrote:

On 5/22/2012 6:00 PM, Bill Unruh wrote:
On Tue, 22 May 2012, William A. Rowe Jr. wrote:

On 5/22/2012 12:02 PM, Bill Unruh wrote:

At that time in the access_log I have a whole bunch of entries like
::1 - - [22/May/2012:09:34:22 -0700] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.2.22
(Mandriva Linux/PREFORK-0.1mdv2010.2) (internal dummy connection)"

That's your own local loopback from a process running on this same box.

There are no processes running on this same box. It is rarely used. and
certainly did not have a browser running at that time.

Then a server module is likely pinging itself.  Any chance you set up an infinite proxy
recursion here?

In the past I have also had connections like 66.249.68.198 - - [22/May/2012:09:35:25
-0700] "GET
/aggregator/www.umsl.edu/~keelr/010/www.twitter.com/www.iaea.org/Publications/Documents/Board/2008/www.environment-agency.gov.uk/homeandleisure/floods/node/www.guardian.co.uk/business/2012/feb/21/node/node/22?page=11

HTTP/1.1" 200 58609 "-" "Mozilla/5.0 (compatible; Googlebot/2.1;
+http://www.google.com/bot.html)"

No clue.  Maybe playing with open proxies?  The document seems to be 58k if that helps you
at all (maybe a local index page?)

There is no such file or path on my system. If I try to use it, I get file not
found. I have nothing called /aggregator/

Looking more and more like a proxy recursion/infinite looping sort of config error.

OK, I do have a "virtual host", www.emergentgravity.org defined on this
system.

In /etc/httpd/conf/vhosts.d/00_default_vhosts.conf I have ---------------------------------------- NameVirtualHost *:80
<VirtualHost *:80>
ServerName www.theory.physics.ubc.ca
ServerAlias theory.physics.ubc.ca
DocumentRoot /usr/local/http/htdocs
</VirtualHost>

<VirtualHost *:80>
  ServerName www.emergentgravity.org
  ServerAlias emergentgravity.org
         DocumentRoot /usr/local/http/htdocs/emergent/drupal.new
</VirtualHost>
-------------------------------------------

This is the whole of that file.
This is supposed to be so that a www.emergentgravity.org address goes to its
drupal document root, and such that anything coming in to
www.theory.physics.ubc.ca comes in to /usr/local/http/htdocs.

If you suspect I have no idea what I am doing in setting this up, you are
correct. Have I managed to stick in a feedback loop in here?



Can you interrupt one of the truly hosed processes using gdb and try 'thread apply all bt'

What does that do?

Dumps all threads instead of just one of them.

Thread 1 (Thread 0xb760f700 (LWP 20861)):
#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb77ece6b in fcntl () from /lib/i686/libpthread.so.0
#2  0xb780f832 in ?? () from /usr/lib/libapr-1.so.0
#3  0xb780f1ad in apr_proc_mutex_lock () from /usr/lib/libapr-1.so.0
#4  0x0809294c in ?? ()
#5  0x08092e0b in ?? ()
#6  0x08093be4 in ap_mpm_run ()
#7  0x08064cd1 in main ()

It might be helpful to first install the debuginfo for the apr/httpd packages, but this

Unfortunately Mandriva never bothered to supply the apache-debug package for
this version of apache.


looks like it might be in the accept queue waiting on the MutexFile to unblock this one
(and is probably a healthy process).

If you are running prefork we would encourage you to try the worker mpm.

Sorry, I have no idea what this sentence means. (prefork, worker mpm)




---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx


--
William G. Unruh   |  Canadian Institute for|     Tel: +1(604)822-3273
Physics&Astronomy  |     Advanced Research  |     Fax: +1(604)822-5324
UBC, Vancouver,BC  |   Program in Cosmology |     unruh@xxxxxxxxxxxxxx
Canada V6T 1Z1     |      and Gravity       |  www.theory.physics.ubc.ca/

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx



[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux