[lug] RE: Redirect code-where does it go? (fwd)
J. Wayde Allen
wallen at its.bldrdoc.gov
Fri Sep 28 13:46:14 MDT 2001
---------- Forwarded message ----------
Date: Thu, 27 Sep 2001 09:55:08 -0600 (MDT)
From: D.J. Atkinson <dj at pcisys.net>
To: J. Wayde Allen <wallen at its.bldrdoc.gov>
Subject: Re: [lug] RE: Redirect code-where does it go? (fwd)
As far as suggestions:
Has justin actually checked to make sure he's getting the redirect? (I.e.
requested /cmd.exe from his machine?) I usually do this by hand using
telnet rather than with a browser. (i.e., "telnet host 80" to connect
then "GET /cmd.exe" once connection has been achieved.)
If he's not getting the redirect, he might try flopping the backslash to a
forward slash in the RedirectMatch command.
They might also add a redirect for root.exe and admin.dll
I've also added one for /default.ida
I hope this helps
On Thu, 27 Sep 2001, J. Wayde Allen wrote:
>---------- Forwarded message ----------
>Date: Thu, 27 Sep 2001 08:32:47 -0600 (MDT)
>From: Justin <glow at jackmoves.com>
>Reply-To: lug at lug.boulder.co.us
>To: lug at lug.boulder.co.us
>Subject: Re: [lug] RE: Redirect code-where does it go?
>I tried that same redirect line verbatum in my httpd.conf and have not
>seen my nimda hits drop at all. I sent an email to the list yesterday
>or the day before to see if that line was actually right but have not
>gotten a response yet.
>> I have seen mentioned over the past few days a redirect solution to
>> nimda/code red worm problem as shown below.
>> RedirectMatch (.*)\cmd.exe$ http://127.0.0.1
>> What page/config file does this go in and what is the full syntax?
>> I have been using php to read the URI and redirect it back to itself
>> seems to work OK, and I have also been using ipchains with manually
>> IP's to deny packets.
>> The problem with my solutions is that they require manual
>> configure the denials/redirects. I would like to do this
>> BTW, the redirects HAVE worked fairly well, the DENY's have worked
>> reducing the amount of bandwidth wasted. One of the other things I
>> that variations of Nimda try to cover their tracks as they are
>> machine by opening another Explorer window. I help them out by
>> counter that opens 500 :) It seems to slow them down a bit...
>> Thanks all,
>> Bill Gates uses a Macintosh.
>> Web Page: http://lug.boulder.co.us
>> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
>glow at jackmoves.com
>Web Page: http://lug.boulder.co.us
>Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
o o o o o o o . . . _______
o _____ _____ ____________________ ____] D D [_||___
._][__n__n___|DD[ [ \_____ | D.J. Atkinson | | dj at pcisys.net |
_/oo OOOO OOOO oo` 'ooooo ooooo` 'o!o o!o` 'o!o o!o`
Visit my web page at http://www.pcisys.net/~dj
More information about the LUG