Redirect Worms Away

---

My site is hosted on an Apache web server.
Why is that? Because, in myhumble opinion, ... IIS web server is in no way ...
to ... web sites (it is ...
as an intranet and My site is hosted on an Apache web server. Why is that? Because, in myhumble opinion, Microsoft's IIS web server is in no way qualified to serviceinternet web sites (it is excellent as an intranet and applications server,however).
Another reason is the vast number of security issues that seem topop up day after day.In point of fact, the Gartner Group has recommended "that businesses hit byboth Code Red and Nimda immediately investigate alternatives to IIS,including moving Web applications to Web server software from other vendorssuch as iPlanet and Apache". http://www4.gartner.com/DisplayDocument?doc_cd=101034But what about those of us who are already hosting their sites on Apacheservers? I've seen lots of articles about how to protect, detect, cleanseand prevent the worms from attacking IIS servers.
While the worms do notpenetrate Apache security, they do cause damage.Some of the damage includes:Server logs get filled with junk - The Nimdaworm alone created over 20,000 entries in a 2 day period in my log files.The server is made very busy - This is especially true if you've got acustom 404 error page, as I do. This means that every time the worm attemptsa penetration, then entire 404 page is returned (in my case, that's about40k).
That adds up to a lot of wasted bandwidth.I thought about this issue for a while after examining my logs and seeingthousands of 404 errors from attempted worm penetrations. Surely there was away to at least reduce the impact of these things? As I saw the 404 errorcount increase, I realized that a significant portion of the bandwidth thatI was paying for was being thrown away.An examination of the log files produced several thousand attempts at eachof the following URLs.
Obviously each of these is the address of a possibleweakness in an IIS server. /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c/winnt/system32/cmd.exe /d/winnt/system32/cmd.exe /scripts/..%2f../winnt/system32/cmd.exe /scripts/..%c1%9c../winnt/system32/cmd.exe /scripts/..%%35%63../winnt/system32/cmd.exe /scripts/ .%%35c../winnt/system32/cmd.exe /scripts/..%c0%2f../winnt/system32/cmd.exe /scripts/..%c0%af../winnt/system32/cmd.exe /MSADC/root.exeThe Apache web server provides a feature called .htaccess, which providescommands to control a web site.
This file is very obscure and extremelyuseful when used properly. You have to be careful when editing .htaccessfiles, as a small mistake can make your web site stop working.
What I liketo do is immediately test the site to be sure it works.Be sure not to make the mistake that I made once - I browsed to my site, sawthat the home page came up, and went to work. Later, I found it was notworking but appeared to work because the home page was stored in my browsercache.
Thus I learned a simple lesson the hard way: always hit the refreshkey of the browser when testing .htaccess changes.I did a little research and testing, and added the following lines to my.htaccess file. redirect /scripts http://www.stoptheviruscold.invalid redirect /MSADC http://www.stoptheviruscold.invalid redirect /c http://www.stoptheviruscold.invalid redirect /d http://www.stoptheviruscold.invalid redirect /_mem_bin http://stoptheviruscold.invalid redirect /msadc http://stoptheviruscold.invalid RedirectMatch (.*)cmd.exe$ http://stoptheviruscold.invalid$1These lines did exactly what I wanted them to do - they stopped the virusfrom creating 404 errors in my log file, and they prevented my 404 errorpage from being triggered, thus creating lots of useless bandwidthutilization.
There is still some bandwidth used, obviously, but it is farless than it would have been. The load on the server is also considerablyreduced, which should make my web hosting company happy.Note that log file entries are still made by the various worms as theyattempt to penetrate the server.
These entries do now show as errors, whichmakes it easier to pick out real errors from the logs. Article Tags: Http://wwwstoptheviruscoldinvalid Redirect Source: Free Articles from ArticlesFactory.com .