Looking through server logs just has to be done regularly. After ignoring mine for some time, I did my regular audit recently and found some unpleasant surprises. My first observation is that the number of bots probing for open proxy servers with syntax such as this:
has increased dramatically. In a single day we get over 1000 such requests from over 400 different IP addresses.
This was an unfortunate waste of bandwidth because we don't show a 403 error page for invalid URLs, instead we redirect invalid URLs to our home page.
The next hassle is the rise of bots looking for web servers which respond to the CONNECT command. I didn't even know this command existed in the spec, but it is listed there, right after GET, POST and HEAD. The typical CONNECT command is:
Where these IPs are well known mail servers. 45 different IPs a day are trying this, some over 100 times per day.
As well as this noise of course there are the normal stream of probes for badly configured php admin programs and other exploitable standard packages:
Here test.txt at 124.0.201.20 is fetched by the vulnerable script, and therefore the script can be used as a dumb proxy server if the URL succeeds.
It is worth paying attention to your access_log and error_log. The amount of noise directed against public web servers has clearly risen as the cost of generating the noise (via compromised bot nets) drops to nearly zero.
On the topic of logs: With the increasing power of web servers to deal with normal traffic, you can also increase the amount of logging they do. Apache 2.x has a useful millisecond per request field which I immediately added to my CustomLog line so that I could write a program to tail the log, and dynamically generate a live chart of response times, request response sizes, and error codes.
Here is a snapshot, but mine refreshes every few seconds:
»
/front/frontend.htmlIf you watch the general shape of this graph it becomes quite easy to determine if things have skewed in some way to the point of abnormality. In fact, I'll probably add to this program to display a long term average on the right and the current very short term view on the left.
home
·
·
·