Here are the relevant pieces of the Apache logfiles: access_log: 65.211.112.6 - - [04/Feb/2003:16:17:30 -0500] "GET /mod_ssl:error:HTTP-request HTTP/1.0" 400 475 217.96.247.140 - - [05/Feb/2003:20:40:47 -0500] "GET /sumthin HTTP/1.0" 404 201 65.211.112.6 - - [06/Feb/2003:09:51:08 -0500] "GET /mod_ssl:error:HTTP-request HTTP/1.0" 400 475 24.52.162.226 - - [07/Feb/2003:01:46:31 -0500] "GET /sumthin HTTP/1.0" 404 201 196.41.30.38 - - [07/Feb/2003:12:37:45 -0500] "GET /sumthin HTTP/1.0" 404 201 ssl_request_log: [04/Feb/2003:16:17:30 -0500] 65.211.112.6 - - "GET /mod_ssl:error:HTTP-request HTTP/1.0" 475 [06/Feb/2003:09:51:08 -0500] 65.211.112.6 - - "GET /mod_ssl:error:HTTP-request HTTP/1.0" 475 error_log: [Tue Feb 4 05:01:54 2003] [error] [client 217.235.56.30] File does not exist: /opt/apache/htdocs/sumthin [Tue Feb 4 16:17:30 2003] [error] mod_ssl: SSL handshake failed: HTTP spoken on HTTPS port; trying to send HTML error page (OpenSSL library error follows) [Tue Feb 4 16:17:30 2003] [error] OpenSSL: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request [Hint: speaking HTTP to HTTPS port!?] [Wed Feb 5 02:37:29 2003] [error] [client 61.102.208.208] File does not exist:/opt/apache/htdocs/sumthin [Thu Feb 6 09:51:08 2003] [error] mod_ssl: SSL handshake failed: HTTP spoken on HTTPS port; trying to send HTML error page (OpenSSL library error follows) [Thu Feb 6 09:51:08 2003] [error] OpenSSL: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request [Hint: speaking HTTP to HTTPS port!?] [Fri Feb 7 01:46:31 2003] [error] [client 24.52.162.226] File does not exist: /opt/apache/htdocs/sumthin [Fri Feb 7 11:12:30 2003] [error] [client 62.110.124.190] Client sent malformed Host header [Fri Feb 7 12:37:45 2003] [error] [client 196.41.30.38] File does not exist: /opt/apache/htdocs/sumthin ssl_engine_log: [04/Feb/2003 05:01:52 14857] [info] Connection to child 8 established (server xxxxx.com:443, client 217.235.56.30) [04/Feb/2003 05:01:52 14857] [info] Seeding PRNG with 1672 bytes of entropy [04/Feb/2003 05:01:52 14857] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] [05/Feb/2003 20:41:09 00431] [info] Connection to child 0 established (server xxxxx.com:443, client 217.96.247.140) [05/Feb/2003 20:41:09 00431] [info] Seeding PRNG with 1672 bytes of entropy [05/Feb/2003 20:41:09 00431] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] [06/Feb/2003 09:51:08 00435] [info] Connection to child 4 established (server xxxxx.com:443, client 65.211.112.6) [06/Feb/2003 09:51:08 00435] [info] Seeding PRNG with 1672 bytes of entropy [06/Feb/2003 09:51:08 00435] [error] SSL handshake failed: HTTP spoken on HTTPS port; trying to send HTML error page (OpenSSL library error follows) [06/Feb/2003 09:51:08 00435] [error] OpenSSL: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request [Hint: speaking HTTP to HTTPS port!?] [07/Feb/2003 01:46:31 00431] [info] Connection to child 0 established (server xxxxx.com:443, client 24.52.162.226) [07/Feb/2003 01:46:31 00431] [info] Seeding PRNG with 1672 bytes of entropy [07/Feb/2003 01:46:31 00431] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] [07/Feb/2003 12:37:45 00435] [info] Connection to child 4 established (server xxxxx.com:443, client 196.41.210.22) [07/Feb/2003 12:37:45 00435] [info] Seeding PRNG with 1672 bytes of entropy [07/Feb/2003 12:37:45 00435] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] [09/Feb/2003 08:32:03 00913] [info] Connection to child 5 established (server xxxxx.com:443, client 210.70.26.71) [09/Feb/2003 08:32:04 00913] [info] Seeding PRNG with 1672 bytes of entropy [09/Feb/2003 08:32:04 00913] [info] Spurious SSL handshake interrupt[Hint: Usually just one of those OpenSSL confusions!?] Three of the apache child processes became wedged, which alerted a monitoring system on Friday (2003/2/7). It looks like the intruder may have gained access as the user apache runs as, and attempted to create or look for a file (not successfully). No other signs of problems; server rebuilt 2003/2/9 against apache-1.3.27 + openssl-0.9.7. -Chuck PS: The machine has detailed monitoring in place, but even so, this incident didn't cause a lot of noise. Certainly not when compared to the logging info generated from ~8000 attempted IIS probes per month.... ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Feb 10 2003 - 20:02:15 PST