There's nothing unusual about those logs at all -- they're normal Apache
logs. The restarts are from SIGUSR1, which means you did something in the
server-manager, or a periodic job ran, which caused a graceful restart of
the webserver. SuEXEC is an Apache feature that lets code execute with
a specific user's permissions, and it's part of the default installation.
There are a couple of lines there where someone has sent a broken Host:
header with a request, which Apache has handled correctly, but reported
for your information. Since so many browsers implement HTTP poorly,
it's not surprising that some would break Host:.
That out of the way, and with risk of sounding repetitive: PLEASE don't
report "I think I might be hacked! Look!" messages to the forums! That's
what security@e-smith.com is for.
Firstly, it's the equivalent of writing a note on your door saying "I think the
lock is broken!", since you've no reason to trust everyone that reads here.
Secondly, it's *also* the equivalent of writing a note on your door saying "I
think everyone with this kind of lock has a broken lock," because if you do
find a real vulnerability in SME Server, there are a lot of people running
the same software that you're exposing. That doesn't help anybody;
letting us know you think you've found a problem and letting us generate
a response, whether a note explaining why it's not a problem or an update
fixing a real vulnerability helps more.
Lastly, it's the equivalent of putting a sign on your door but not telling
the locksmith -- these forums are unsupported, and there's no guarantee
that anyone from Mitel Networks will see your post. But mail sent to the
address designated for security concerns, security@e-smith.com, will
always receive priority attention.
The SME Server team takes security concerns very seriously -- please help
us do so.
Thanks,
--Rich
11 Replies
2120 Views