发一个php 攻击代码.大家注意.

狒狒

  当年我网站的代码可比这来劲多了 idc 封了我的网站我还没反应过来呢

cxm

把  fsockopen  函数禁用了这个代码就应该失效了。

coollyct

这玩意看不出实际意义。。。

Administrator

原帖由 cpuer 于 2010-12-4 13:11 发表


把  fsockopen  函数禁用了这个代码就应该失效了。

如果虚拟主机的话客户的程序可能需要用fsockopen
个人认为过滤UDP包比较好.


感谢.已经禁用了那个函数.平时没怎么注意...谢谢楼上各位.

moto72

在nginx+php下面可以强行设置超时时间为30秒，到了30秒自动结束进程。

cpuer

原帖由 netroby 于 2010-12-4 13:54 发表


在nginx+php下面可以强行设置超时时间为30秒，到了30秒自动结束进程。

我的是apache.不过我同样设置了超时时间,但这个超时时间对这个脚本是无效的.

另外,如果封了fsockopen函数,很多网站可能就不能用了.该如何解决?

jiangchunlin

Oct 17 04:09:38.261791 [WARNING] [pool www] child 28393, script '/xxx/index.php' execution timed out (30.064970 sec), terminating


设置选项在php fpm里



; The timeout for serving a single request after which the worker process will
; be killed. This option should be used when the 'max_execution_time' ini option
; does not stop script execution for some reason. A value of '0' means 'off'.
; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
; Default Value: 0
request_terminate_timeout = 30

greensnow

原帖由 domin 于 2010-12-4 13:52 发表




如果虚拟主机的话客户的程序可能需要用fsockopen
个人认为过滤UDP包比较好.

请教具体怎么弄？

domin诡谲

apf 有过滤UDP包的.我去设置下.谢谢domain提醒.

netroby

[ol]

# Configure outbound (egress) accepted services. This is an optional

# feature; services and customized entries may be made directly to an ip's

# virtual net file located in the vnet/ directory.

#

# Outbound (egress) filtering is not required but makes your firewall setup

# complete by providing full inbound and outbound packet filtering. You can

# toggle outbound filtering on or off with the EGF variable. Format is comma

# separated and underscore separator for ranges.

#

# Example:

# EG_TCP_CPORTS="21,25,80,443,43"

# EG_UDP_CPORTS="20,21,53"

# EG_ICMP_TYPES="all"

# Outbound (egress) filtering

EGF="0"

# Common outbound (egress) TCP ports

EG_TCP_CPORTS="21,25,80,443,43"

# Common outbound (egress) UDP ports

EG_UDP_CPORTS="20,21,53"

# Common ICMP outbound (egress) types

# 'internals/icmp.types' for type definition; 'all' is wildcard for any

EG_ICMP_TYPES="all"[/ol]复制代码