On Mon, Aug 29, 2011 at 4:17 PM, Always Learning <cen...@u61.u22.net> wrote: >> That means he's not very good at it yet. The ones you need to worry >> about will send quick exploit tests cycling through different >> destinations, that if they succeed will post to a central receiver. >> Then later, likely from a different location, it will send the one >> that attempts to escalate access to root and/or establish a connection >> back for central control. The point here being that an IP block >> probably won't help much against an exploit that works well enough to >> establish a distributed base. > > Thank you for this. > > If I can establish an effective block for wrong HTTP requests in > IPtables for incoming port 80 traffic, back-upped by my Apache routine > adding IPs to IPtables or .htacesss file and having screwed down access > and egress for all other traffic, the only other enhancement I need is > SELinux ?
It's always hard to guess what the next successful exploit might be. With web servers they tend to be URLs that can be misparsed (by apache or application level code) into arbitrary commands which may or may not be combined with writing files somewhere and then trying to execute them. You can avoid a lot of the problems by making sure that apache can't write anywhere that is mounted with execute capability. -- Les Mikesell lesmikes...@gmail.com _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
