We’ve seen the articles about how to find out if you’re vulnerable to the bash shellshock bug, we’ve also seen the articles on how to patch your system. What I’ll show you is how to find out if people are testing your system.
First, ssh into your server and find your http access logs. Some common places are:
cPanel: /usr/local/apache/domlogs/
Debian/Apache: /var/log/apache2/
CentOS: /var/log/httpd/
Once you find them, you can cat them, grepping for this pattern:
|
1 |
cat access_log |grep "{ :;};" |
You can make it prettier by using awk…
This will show me the IP addresses that have tried it..
|
1 |
cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq |
(print $1 means print the first column. Your access log might have the IP in a different column.. try $3 if $1 doesn’t work)
This will show me how many times each IP hit me:
|
1 |
cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq -c |
Then, i can take it further by using csf to block anyone who’s tried it:
|
1 |
for x in $(cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq);do csf -d $x;done |
Related posts from Linux Brigade!
Add time and date to your bash history Often, you’ll go looking for a shell command that you used in the past – you can remember around when you did it but of course that won’t help you because by default the bash history won’t […]
Install nrpe on XenServer If you are using nagios in your hosting environment and need to install nrpe on your XenServer servers, here’s a good way to do it.
I’m using XenServer 6.1 (latest version).First, […]
Migrate CXS license from one server to another When you upgrade servers, you usually like to take things you paid for with you to your new one. This will show you how.
So you want to migrate CXS license from one server to […]
How to use GNU Screen in Linux Screen is billed as a “full-screen window manager that multiplexes a physical terminal between several processes (typically interactive shells)” (from the man page). Linux admins use […]- Run fsck on a XenServer Virtual Machine You hope that you won’t ever need to, but you may one day need to run fsck on a Linux XenServer VM that won’t boot.. no worries, attach the storage from that VM on another VM and run it […]
