We’ve seen the articles about how to find out if you’re vulnerable to the bash shellshock bug, we’ve also seen the articles on how to patch your system. What I’ll show you is how to find out if people are testing your system.
First, ssh into your server and find your http access logs. Some common places are:
cPanel: /usr/local/apache/domlogs/
Debian/Apache: /var/log/apache2/
CentOS: /var/log/httpd/
Once you find them, you can cat them, grepping for this pattern:
|
1 |
cat access_log |grep "{ :;};" |
You can make it prettier by using awk…
This will show me the IP addresses that have tried it..
|
1 |
cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq |
(print $1 means print the first column. Your access log might have the IP in a different column.. try $3 if $1 doesn’t work)
This will show me how many times each IP hit me:
|
1 |
cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq -c |
Then, i can take it further by using csf to block anyone who’s tried it:
|
1 |
for x in $(cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq);do csf -d $x;done |
Related posts from Linux Brigade!
Add time and date to your bash history Often, you’ll go looking for a shell command that you used in the past – you can remember around when you did it but of course that won’t help you because by default the bash history won’t […]
Can’t afford a full time Linux admin? If you’re just starting out, it’s tough being able to afford full time Linux support. Why not employ Hosting Support Services instead? We’re Red Hat certified, fluent with Red […]
How to use GNU Screen in Linux Screen is billed as a “full-screen window manager that multiplexes a physical terminal between several processes (typically interactive shells)” (from the man page). Linux admins use […]
Warning: Skipping the data of table mysql.event. Your MySQL script was running great, but then you started getting errors – If you get this warning when dumping the mysql database, it’s not a bug – MySQL did this on purpose because they […]
Turn off unneeded services on your Linux machine One of the easiest ways to start securing your server (and speeding it up) is to turn off unnecessary services that are usually running by default. This little script will go through and […]
