Re: [users@httpd] apache attack

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Update apache to 1.3.33 - security patches.
Update PHP to 4.3.10 - security patches.  Consider applying the hardened PHP     
patches written by Stefan Esser http://www.hardened-php.net/

Unless the php script is threaded or forked or something like that, which I 
doubt, your problem is most likely not there - apache started falling over at 
15:10, the php mailing script was finished at 14:47.  If you want to be sure, 
test this by copying the script to a test area and setting up a test scenario 
where you get the mails at some different mail accounts.

Look at what scripts were called in the few minutes before apache started 
having problems and up until the time where you stopped apache.  If there is 
something solid to find, it will most likely be in this time frame.

Consider setting the apache log level to info until you've found the source of 
the problem, or at least while you're testing.  Maybe with this logging level 
you can get more information should the situation come up again.  Make 
similar settings with mysql.

Without sufficient logging, it's difficult to see what you problem was.  At 
best you can try to reproduce the problem, then take steps to prevent it 
happening again.

Markus


On Tuesday 29 March 2005 19:17, seb hould wrote:
> Apache 1.3.29
> RedHat Linux 9, kernel 2.4.20-31.9
> PHP 4.3.4
> MySQL 4.1.7
>
> First all thanks for the tips.  I checked the MySQL error logs but
> unfortunately it is not as verbose as I wish it would be.  The
> /var/log/message tells me the first apache process killed was at 15:10
> (so it maxed at that time).  So I looked at all the requests from that
> time up until 15:27 when I stopped Apache.  There were continuous
> requests but I believe these were requests that Apache could serve
> without the help of the db (this is not 100% checked but it does seem
> like it) and there seem to be less requests than in usual
> circumstances.  The Apache error log reports nothing unusual.  I did
> get a tip though that a user ran a newsletter-sending PHP script
> roughly at 14:47.  The script has been used many times before and
> never failed but it does issue many SQL requests.   The culprit is
> probably the MySQL server.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
>    "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
> For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
   "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx



[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux