> From: John Young > Sent: Wednesday, December 21, 2005 5:55 PM > > John1 wrote: > > > I am surprised that not more Interchange sites have reported being > > affected by this on this mailing list. So far only 3 of us have > > reported experiencing this problem which would suggest that it is > > something peculiar to our installations, and yet I am sure it isn't. If > > anyone else is seeing the same problem with there Interchange site going > > down please post a brief reply to this thread - thanks. > > > Well, I'll offer up that I see those same worm-initiated requests > every day and my server hasn't suffered from it. I'm using a modified > IC 5.1.x with mod_interchange (slightly old version). I think we've found it occurs regardless of IC/mod_interchange/apache version. At least in my case I've tried different versions of Apache and mod_interchange and have seen posts from people using different versions of IC (we are on modified version of 4.8.x). It'll be interesting to see if we have this same problem when we move to the latest and greatest. > If you can't reproduce the worm in a lab, then perhaps you can set up > another server, and using mod_rewrite or some such thing on your > production > server redirect those requests to the secondary server. Doesn't have to > be an additional physical box -- could just be additional instances of > Apache and Interchange (provided you have the memory). That might protect > your production server as well as give you a place to work on figuring > the thing out (by turning things on and off, etc.). > > -John Young We do have the resources to setup such a system, nearly identical to the existing server. Is there a way to use an apache module perhaps to copy all requests from one server to another? We don't really want to just rewrite the worm requests, because we need to recreate the complete traffic patterns as well. I will look into this some more. A reproducible case would really be the easy route to help debug this issue. -Ron _______________________________________________ interchange-users mailing list suppressed http://www.icdevgroup.org/mailman/listinfo/interchange-users
Mail converted by mhonarc 2.6.15
This archive provided courtesy of JSW4.NET, Internet Hosting Services for Small Business.