Re: That crazy Code Red worm...

[Stephanie Wright <swright@xxxxxxxxx>]

> ahhhh I think maybe I jumped the gun.......you are looking to ban an
> ip.........you can deny a specific ip in the apache.conf file (OSXS) and I
> beleive its the httpd.conf file in OSX
>
> C

The request still has to be processed by the server. A deny gains you nothing.

Not to mention that (almost) every request comes from a different 
IP#, there are thousands of compromised servers sending out the 
request. Even if you knew every compromised server's IP #, nobody is 
going to add 10,000 denies to their config file.

iTools servers don't have the file being requested - "default.ida" - 
so requests generate a 404 file not found. So what, it hurts nothing. 
Even if your box is getting 10 requests a minute (more than I've seen 
reported by anyone), that shouldn't be much impact on a server.

If you have a low traffic server, it will be noticeable, but barely a 
drop in  the bucket on a high volume machine.

> Alain Russell wrote:
>
> >  Grab a copy of the OSX firewall config program from versiontracker.com - not
> >  sure what it was called now and deny all requests on port 80/81 from the
> >  particular IP address you are not happy with.
> >
> >  That should fix it.
> >  Alain
> >
> >  > Is there anything we [iTools/OSX] need to worry about with this? My box is
> >  > getting hammered with requests for default.ida across all 
> > domains. Is there
> >  > a way to block requests for that file?
> >  >
> >  > Also, unrelated... Is there a way to block a specific referrer? I have a
> >  > outside site that is deep linking to some content despite 
> > requests to stop.
> >  >
> >  > Thank you..  Stace
> >  >
> >  >
> >  > ---
> >  > Tenon Intersystems' itools Mailing List
> >  > To unsubscribe: send mailto://itools-request@xxxxxxxxxxxxxxx
> >  > with the body: unsubscribe
> >  >
> >
> >  ---
> >  Tenon Intersystems' itools Mailing List
> >  To unsubscribe: send mailto://itools-request@xxxxxxxxxxxxxxx
> >  with the body: unsubscribe
>
>
> ---
> Tenon Intersystems' itools Mailing List
> To unsubscribe: send mailto://itools-request@xxxxxxxxxxxxxxx
> with the body: unsubscribe

--
    Stephanie J. Wright

---------------------------------------------------------------------
Tenon Intersystems                                       805-963-6983
1123 Chapala Street                                 swright@xxxxxxxxx
Santa Barbara, CA 93101                          http://www.tenon.com
---------------------------------------------------------------------

---
Tenon Intersystems' itools Mailing List
To unsubscribe: send mailto://itools-request@xxxxxxxxxxxxxxx
with the body: unsubscribe