Bug 44836 - New port: hunch - Scan httpd log files, find vulnerability probes, mail admins
Summary: New port: hunch - Scan httpd log files, find vulnerability probes, mail admins
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2002-11-02 18:50 UTC by Dan Pelleg
Modified: 2003-08-28 10:21 UTC (History)
0 users

See Also:


Attachments
file.shar (10.83 KB, text/plain)
2002-11-02 18:50 UTC, Dan Pelleg
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dan Pelleg 2002-11-02 18:50:03 UTC
Scan Apache log files for CodeRed, Nimda, FormMail, proxy scanners and
other malicious probes. For each one found, track down the contact email
from WHOIS data and send a notice. Built-in rate controls prevent flooding
an admin even when his machines are scanning at high rates. Runs as a
non-privileged cron job to not interfere with the HTTP daemon's operation.

Notes to committer:

 1. This port installs a user and a group "hunch". It doesn't meet the
conditions listed in the handbook for a "reserved" uid/gid.

 2. portlint will complain about the port. A lot. To the best of my
judgment all of the warnings can be ignored with the exception of
the one about BATCH which I could find no documentation for. Therefore
it is setting IS_INTERACTIVE.
Comment 1 Edwin Groothuis freebsd_committer freebsd_triage 2003-08-28 10:21:29 UTC
State Changed
From-To: open->closed

Commited, thanks!