Monat: März 2010

If you find the following in the error.log of an apache webserver:

… [error] [client XXX.XXX.XXX.XXX] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): …

You can be sure that in most cases it is a computer, largely even running a webserver and many other services, with no firewall, lacking security precautions, xampp and phpmyadmin open to everybody, empty passwords, etc. sometimes they have all of these features at once. I have not checked for viruses but I expect most of them to even be infected or at least hacked and working for someone else than they ought to.

It is most likely that they send the request to your web server without the owner knowing about this. But one thing is for certain:

1. It causes traffic
2. Costs energy
3. Spams your logs
4. Etc. etc.

And all this because the computer administrator/owner has not made an effort to secure the computer at a minimum.
Go to your apache log directory an check if the same is happening to you using the following commands:

less error.log | grep RFC2616 | awk ‚{print $8}‘ | sort | uniq
less error.log | grep RFC2616 | awk ‚{printf(„%s %s %s\n“, $3, $4, $8)}‘

Further reading:

• w3.org RFC2616 section 14.23
• it.toolbox.com The first day in the life of a webserver
• isc.sans.org The first day in the life of a website

If the error „mod_mime_magic: invalid type 0 in mconvert()“ appears in your HTTP-Server e.g. apache log, it’s most probably a faulty mime-magic configuration. Do the following:

tail -f /var/log/apache2/error.log

Go to another console

sudo apache2ctl restart

Look at the errors uncomment the lines causing the Problems in

/usr/share/file/magic.mime

with your favorite editor. Repeat »apache2ctl restart« and watch the log again until tail does not show any more errors of this kind.