We’ve seen the articles about how to find out if you’re vulnerable to the bash shellshock bug, we’ve also seen the articles on how to patch your system. What I’ll show you is how to find out if people are testing your system.
First, ssh into your server and find your http access logs. Some common places are:
cPanel: /usr/local/apache/domlogs/
Debian/Apache: /var/log/apache2/
CentOS: /var/log/httpd/
Once you find them, you can cat them, grepping for this pattern:
|
1 |
cat access_log |grep "{ :;};" |
You can make it prettier by using awk…
This will show me the IP addresses that have tried it..
|
1 |
cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq |
(print $1 means print the first column. Your access log might have the IP in a different column.. try $3 if $1 doesn’t work)
This will show me how many times each IP hit me:
|
1 |
cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq -c |
Then, i can take it further by using csf to block anyone who’s tried it:
|
1 |
for x in $(cat linuxbrigade.com |grep "{ :;};"|awk '{print $1}'|uniq);do csf -d $x;done |
Related posts from Linux Brigade!
Add time and date to your bash history Often, you’ll go looking for a shell command that you used in the past – you can remember around when you did it but of course that won’t help you because by default the bash history won’t […]
Check, repair, optimize all databases with one command My server had some tables marked as ‘crashed’ in one of the databases.. the server had recently gone down pretty harshly so I wanted to go through and check, repair and optimize all of the […]
Can’t afford a full time Linux admin? If you’re just starting out, it’s tough being able to afford full time Linux support. Why not employ Hosting Support Services instead? We’re Red Hat certified, fluent with Red […]
Install Ubuntu / Xubuntu from USB Installing via USB is much better/easier than via cd/dvd simply because it’s not going to get scratched up, you can easily carry it around with you to loan to friends, etc..
Let’s set […]
Block account from sending mail WHM/cPanel There may come a time when you’d like to block an account / domain on your WHM/cPanel server from being able to send mail. Here’s how you’d get it done!
We’re going to set up a […]
