Help.. I think the NIMDA virus is knocking out my SCO Web server.
Con Torrisi
Ever since the NIMDA virus hit our web server has been stopping. Its a SCO
5.0.2 with Netscape 1.12. Everything else on the system is working fine
(e.g. mail telnet etc) but it wont serve web pages. Doing a "restart" on the
web server component gets it going again for a short time but it will soon
stop.
I don't think it has the virus but other infected Microsoft machines are
attacking it and I think thats doing the damage.
Any help greatly appreciated.
Con
-----------------------------------------------------------
Con Torrisi
Bretts-IT Information Technology Manager
Webmaster - Systems Administrator
Mobile: 0418 880103
Work: 61 7 33610533
URL: http://www.bretts.com.au/~con
Email: c...@bretts.com.au
steve overy
> Hi everyone,
>
> Ever since the NIMDA virus hit our web server has been stopping. Its a SCO
> 5.0.2 with Netscape 1.12. Everything else on the system is working fine
> (e.g. mail telnet etc) but it wont serve web pages. Doing a "restart" on the
> web server component gets it going again for a short time but it will soon
> stop.
>
> I don't think it has the virus but other infected Microsoft machines are
> attacking it and I think thats doing the damage.
>
> Any help greatly appreciated.
>
> Con
>
yes, we've seen problems on our well patched (inc security patches)
lab uw711 - the web server (netscape) was fine but the first symptom
was basename failing, cron jobs not running - cron log showed jobs
failing rc=1, looking at the /var/adm/sa showed last data 17 sept -
ring any bells? turned out even the console login was failing,
shutdown not working. Terminated the system with extreme prejudice &
rebooted clean. maybe some dynamic libs got corrupt?
steve
Matt Schalit
There used to be a discussion on the www.sco.com/security/
site for UnixWare 7.1.1 that described a defense against
denial of service.
It was a tunable parameter or the like, which is set to 0
by default (unlimited) but can be set to, let's say, 300.
After 300 requests for a service, the additional requests
would be discarded on an intelligent basis like a modified
first-in-first-out.
Do you have that enabled, Steve?
I can't find the reference... www.sco.com/security/ is
offline, and not replicated the same way on Caldera's site.
I didn't copy it into the FAQ because I didn't want to
plagarize them, and now it's gone.
Matt
steve overy
Matt,
thats news to me - so I dont have the tunable... I never even
noted a discussion group under the security pages - maybe I wasn't
looking properly.
Whilst I'm associating this with nimda I'm not convinced... I assumed
denial of service was due to message floods not that it corrupted the
os! (also I see nothing in the advisories that suggests nimda attacks
unix)
steve
Matt Schalit
Yea, I see what you mean. We're talking about the same thing,
it's likely a flood problem rather than your web server being
affected. So perhaps a network monitor on a promiscuous host
would help you determine the volume of requests your getting
and then you could set the syn flood tcp_q0limit parameter to
a value less than that on your SCO box.
Luckily for us (heh, heh), Bela's still lurking, and sent
me a reply from Caldera on a different thread, but about this
problem, reminding me of the name and the url's:
|I _think_ what you're referring to is the SYN flood protection afforded
|by the parameter "tcp_q0limit". It's described at:
|
| http://docsrv.caldera.com:1997/cgi-bin/man/man?inconfig+1Mtcp
| http://docsrv.caldera.com:1997/cgi-bin/man/man?listen+3sock
| http://docsrv.caldera.com:1997/SM_perform/_Networking_Parameters.html
|
|The machine(s) you're trying to protect should have these as
|inconfig(1Mtcp), listen(3sock), and
|http://localhost/SM_perform/_Networking_Parameters.html.
|
|Also look for the related parameter "tcp_initial_timeout".
|
|The OSR506 doc has a more complete discussion of the q0limit parameter
|vs. SYN floods:
|
| http://osr5doc.ca.caldera.com:457/NetAdminG/nwRs_SYNflood.html
|
|>Bela<
Cheers,
Matt