Ein paar Fragen zu logfiles

[landyphil]

Hallo Leidgeplagte Admins,

Ja wie viele Admins mit Joomla Installationen werden die Nächte kurz, So schnell kan man ja nicht updaten wie die Hacker die Seiten bombardieren. Eins ist sicher ich habe definitiv den Spaß daran verloren und werde mich wohl aufs Layout beschränken .

Ich habe einen 1&1 root Server und am letzten Freitag 22.09 reinitialisiert.
Folgende Checkliste ist abgearbeitet:

-Neue Passwörtern für jeden Bereich
- Reinstallation der Joomla Seiten mit aktuellsten Core
- Entfernen aller instabiler 3rd party Komponenten (http://forum.joomla.org/)
- Updaten aller 3rd Party Komponenten
- Neue Passwörter im Joomla
- Neue Datenbanknamen /Nutzer / Passwörter
- Admin Bereich Joomla zusätzlich geschützt durch .htacces (.htpassw im root Verzeichnis)


Nach der reinitialisierung versuche ich nun alles aus meinen Logfiles zu lesen verstehe aber anscheinend zu wenig . Vielleicht habt Ihr eine Antwort:

Werde ich hier gescannt?
Kann ich etwas dagegen unternehmen?

Code: Select all

[b]Aus der error_log[/b]
______________


[Mon Sep 25 22:58:52 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/phpmyadmin
[Mon Sep 25 22:58:52 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/PMA
[Mon Sep 25 22:58:52 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/mysql
[Mon Sep 25 22:58:52 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/admin
[Mon Sep 25 22:58:53 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/db
[Mon Sep 25 22:58:53 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/dbadmin
[Mon Sep 25 22:58:53 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/web
[Mon Sep 25 22:58:53 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/admin
[Mon Sep 25 22:58:54 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/admin
[Mon Sep 25 22:58:54 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/admin
[Mon Sep 25 22:58:54 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/mysql-admin
[Mon Sep 25 22:58:54 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/phpmyadmin2
[Mon Sep 25 22:58:54 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/mysqladmin
[Mon Sep 25 22:58:55 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/mysql-admin
[Mon Sep 25 22:58:55 2006] [error] [client 207.14.166.253] script '/srv/www/vhosts/default/htdocs/main.php' not found or unable to stat
[Mon Sep 25 22:58:55 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.5.6
[Mon Sep 25 22:58:55 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.5.4
[Mon Sep 25 22:58:55 2006] [error] [client 207.14.166.253] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.5.1


[b]Aus der Acceslog:[/b]
______________

207.14.166.253 - - [25/Sep/2006:22:58:52 +0200] "GET /phpmyadmin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:52 +0200] "GET /PMA/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:52 +0200] "GET /mysql/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:52 +0200] "GET /admin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:53 +0200] "GET /db/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:53 +0200] "GET /dbadmin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:53 +0200] "GET /web/phpMyAdmin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:53 +0200] "GET /admin/pma/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:54 +0200] "GET /admin/phpmyadmin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:54 +0200] "GET /admin/mysql/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:54 +0200] "GET /mysql-admin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:54 +0200] "GET /phpmyadmin2/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:54 +0200] "GET /mysqladmin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:55 +0200] "GET /mysql-admin/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:55 +0200] "GET /main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:55 +0200] "GET /phpMyAdmin-2.5.6/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:55 +0200] "GET /phpMyAdmin-2.5.4/main.php HTTP/1.0" 404 1036 "-" "pmafind"
207.14.166.253 - - [25/Sep/2006:22:58:55 +0200] "GET /phpMyAdmin-2.5.1/main.php HTTP/1.0" 404 1036 "-" "pmafind"

Was passiert hier genau?

Code: Select all

[Fri Sep 22 22:11:22 2006] [warn] child process 7484 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7490 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7481 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7810 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7496 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7507 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7483 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7607 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [warn] child process 7608 still did not exit, sending a SIGTERM
[Fri Sep 22 22:11:22 2006] [notice] [b]caught SIGTERM, shutting down[/b]
[Fri Sep 22 22:13:01 2006] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
[Fri Sep 22 22:13:01 2006] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Fri Sep 22 22:13:01 2006] [warn] RSA server certificate CommonName (CN) `s152*****.onlinehome-server.info' does NOT match server name!?
[Fri Sep 22 22:13:01 2006] [notice] [b]suEXEC mechanism enabled (wrapper: /usr/sbin/suexec2)[/b]
[Fri Sep 22 22:13:01 2006] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Fri Sep 22 22:13:01 2006] [warn] RSA server certificate CommonName (CN) `s152*****7.onlinehome-server.info' does NOT match server name!?
[Fri Sep 22 22:13:02 2006] [notice] [b]mod_python: Creating 32 session mutexes based on 150 max processes and 0 max threads.[/b]
[Fri Sep 22 22:13:02 2006] [notice] Apache/2.0.53 (Linux/SUSE) configured -- resuming normal operations



[Mon Sep 25 19:37:47 2006] [error] [client 66.249.72.163] File does not exist: /srv/www/vhosts/default/htdocs/robots.txt
[Mon Sep 25 19:38:52 2006] [error] [client 66.249.72.163] File does not exist: /srv/www/vhosts/default/htdocs/forum_php
[Mon Sep 25 19:45:03 2006] [notice] Graceful restart requested, doing restart
[Mon Sep 25 19:45:04 2006] [warn] RSA server certificate CommonName (CN) `plesk' does NOT match server name!?
[Mon Sep 25 19:45:04 2006] [warn] RSA server certificate CommonName (CN) `s15205427.onlinehome-server.info' does NOT match server name!?
[Mon Sep 25 19:45:04 2006] [notice] mod_python: Creating 32 session mutexes based on 150 max processes and 0 max threads.
[Mon Sep 25 19:45:04 2006] [notice] Apache/2.0.53 (Linux/SUSE) configured -- resuming normal operations
[Mon Sep 25 19:50:19 2006] [error] [client 84.175.230.150] File does not exist: /srv/www/vhosts/default/htdocs/forum.de
[Mon Sep 25 19:54:52 2006] [error] [client 64.242.88.50] File does not exist: /srv/www/vhosts/default/htdocs/content
[Mon Sep 25 20:30:49 2006] [notice] child pid 26942 exit signal Segmentation fault (11)
[Mon Sep 25 20:30:53 2006] [notice] child pid 26910 exit signal Segmentation fault (11)
[Mon Sep 25 20:30:58 2006] [notice] child pid 26911 exit signal Segmentation fault (11)
[Mon Sep 25 20:41:55 2006] [notice] child pid 28057 exit signal Segmentation fault (11)
[Mon Sep 25 20:41:59 2006] [notice] child pid 28255 exit signal Segmentation fault (11)
[Mon Sep 25 20:49:23 2006] [error] [client 64.242.88.50] File does not exist: /srv/www/vhosts/default/htdocs/content
[Mon Sep 25 20:54:50 2006] [error] [client 64.242.88.50] File does not exist: /srv/www/vhosts/default/htdocs/component
[Mon Sep 25 21:05:46 2006] [notice] child pid 30923 exit signal Segmentation fault (11)

Schon mal Danke im Voraus
Landyphil

[theomega]

Hy
gegen die Scans kannste nichts machen, habe ich auf meinemn Server auch.
Dein Error-Log sieht komisch aus, vor allem der "Segmentation fault" ist komisch. Allerdings würde ich weniger auf einen Hack tippen als auf deffekte Binaries. Was ist das für eine Konfirguratio bzw wie wird PHP eingebunden?

[landyphil]

Hy
gegen die Scans kannste nichts machen, habe ich auf meinemn Server auch.
Dein Error-Log sieht komisch aus, vor allem der "Segmentation fault" ist komisch. Allerdings würde ich weniger auf einen Hack tippen als auf deffekte Binaries. Was ist das für eine Konfirguratio bzw wie wird PHP eingebunden?

Danke für die Antwort.
defekte binaries währe ja komisch. Der Server ist am 22.09 reinitialisiert und bis auf die plesk updates und die Updates per Yast unveränderd. Kann man nicht davon ausgehen das ein unverändertes und von Provider bereitgestelltes System nahezu fehlerfrei läuft?
Ich bin derzeit, nach 2 Hacks in diesem Jahr, nur ein wenig in Sorge sofern ich logs finde welche mir nichts sagen.

cu
Phil