Re: false positive http probe reports from routine 408

Well, sure, one way to eliminate false positives is to suppress all of 
these tests. I was looking for something a bit less drastic, but if 
you're deprecating the exploit tests anyway then I guess turning them 
off makes sense. I already run a separate scan through the logs for the 
exploits that are of greatest concern to us anyway, and null requests 
are not particularly concerning.

On 2018-10-14 22:24, Bjorn via Logwatch-devel wrote:
> Thanks for pointing that out.  Unfortunately the "exploit list" is
> severely broken - it is not maintained, it is out of date, it was never
> complete or comprehensive, so its use is deprecated.  A variable called
> HTTP_IGNORE_ERROR_HACKS was added so that it could be disabled from the
> service configuration file.
>
> I've chosen to remove the "null" entry from that list.  Let me know if
> that does not fix your issue.
>
>
>
> Bjorn
>
>
>
> On 10/02/2018 10:25 AM, Gilles Detillieux wrote:
>> Earlier, I wrote:
>>> There's a long-standing false-positive in the http service script which
>>> I finally got around to looking into and patching. When Apache logs 408
>>> Request timeout errors, it logs these with a null request field (just a
>>> "-"). These are routine errors when the client keeps the socket open too
>>> long without a request, but they're reported as probes/known hack
>>> attempts. This patch quiets down that noise, just giving a count of 408
>>> errors at the end...
>> Unfortunately Thunderbird changed a bunch of the spaces in the patch to
>> non-breaking spaces, which might make the patch hard to apply unless you
>> hand-edit. Here's a cleaner version...
>>
>> --- logwatch-7.4.3/scripts/services/http.orig	2016-03-30 16:32:34.000000000 -0500
>> +++ logwatch-7.4.3/scripts/services/http	2018-10-02 10:55:19.000000000 -0500
>> @@ -387,6 +387,8 @@ while (my $line = <STDIN>) {
>>      ($field{method},$field{url},$field{protocol}) = split(/
>> +/,$field{"request"});
>>      if (! $field{url}) {
>>         $field{url}='null';
>> +#     don't count timeout errors as null requests...
>> +      $field{url}='-' if $field{http_rc} == 408;
>>      }
>>      $field{lc_url} = lc $field{url};
>>   
>>
>>

-- 
Gilles R. Detillieux              E-mail: <grdetil-b3I9/Z444iDkHagxZOarhfd9D2ou9A/[email protected]>
Spinal Cord Research Centre       WWW:    http://www.scrc.umanitoba.ca/
Dept. of Physiology and Pathophysiology, Faculty of Health Sciences,
Univ. of Manitoba  Winnipeg, MB  R3E 0J9  (Canada)