fixed 404s

[Mon Nov 3 11:18:58 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/newsletter/01-4/2001-4.pdf
FIXED: -> 01-4.pdf

[Mon Nov 3 11:21:37 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/aviation/2003/download.php
FIXED: -> /aviation2003downloads/
in /aviation/2003/index.php

also:
/aviation2000downloads/
FIXED: -> /aviation/2000/
in /aviation/2004/index.php, /aviation/2005/index.php


[Sun Nov 2 01:57:47 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/2004techtopics.pdf
[Sun Nov 2 01:57:47 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/2002techtopics.pdf
[Sun Nov 2 01:57:50 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/2006techtopics.pdf
[Sun Nov 2 01:58:17 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/1999techtopics.pdf
[Sun Nov 2 01:59:22 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/1998techtopics.pdf
[Sun Nov 2 01:59:22 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/2005techtopics.pdf
[Sun Nov 2 01:59:23 2008] [error] [client 169.229.192.166] File does not exist: /usr/local/apache/htdocs/sitemap/2001techtopics.pdf

fixed in: /sitemap/index.php

Newsletter

I also fixed a LOT of broken links in older newsletter folders (.html instead of .php, old paths that were replaced 3 or 4 years ago...)

Newsletters from late 2006 and all of 2007 didn't have index.php pages, so I copied HTML from the newsletter/archive page into new index pages for each issue in 2007. Still need to do 2006.

Finding 404s

Today I once again tail'ed the error log, and fixed a bunch of broken links to /freestuff/store.php

Then there are a lot of SSL errors...

Ooh! and I fixed some broken image links in the 2003 Summer newsletter...

Web Server Stats: What to do with hax0r traffic

In my ongoing quest to produce a measure of real human use of the site, I now come to malicious traffic.

First thing: how to identify malicious traffic?

In an earlier post I describe creating Fake hacker targets like /_vti_bin/owssvr.dll (on our LAMP server). I could grep access logs for known malicious URLs like that. Problem: high maintenance. The bad guys are always discovering and trying new vulnerabilities, and I would have to somehow keep up.

I could look for large numbers of 404s per host, since probes for vulnerabilities will fail. (Well, they would if I removed the fake targets.)

Fake hacker targets?

Today I created the following empty files:

• /display.php
• /errors.php
• /popup_window.php

these are often requested by script kiddies (display.php thousands of times a month); now we are serving empty docs instead of returning 404 errors.

Is this an improvement?

For us, it means fewer lines in the error logs, and more useful Analog reports.

Does it cause hassle for script kiddies? Presumably their script shows them all non-404 results; will they spend a few seconds trying to figure out our empty doc? And is it dangerous to attract this kind of attention?

Update January 7, 2008:

My colleague Jon Felder says "do it," so I'm adding:

• /_vti_bin/owssvr.dll
• /_vti_bin/shtml.exe/_vti_rpc
• /_vti_inf.html
• /account.php
• /calendar.php
• /cart_content.php
• /confirmUnsubscription.php
• /errors.php
• /fax_form.php
• /freestuff/account.php
• /freestuff/cart_content.php
• /freestuff/popup_window.php
• /freestuff/squirrelcart/js/cart_content.php
• /freestuff/squirrelcart/js/popup_window.php
• /freestuff/squirrelcart/js/squirrelcart/cart_content.php
• /freestuff/squirrelcart/popup_window.php
• /freestuff/squirrelcart/squirrelcart/cart_content.php
• /MSOffice/cltreq.asp
• /newsletter/05-3/errors.php
• /newsletter/confirmUnsubscription.php
• /newsletter/errors.php
• /newsletter/newsletter.php
• /newsletter/newsletter/newsletter.php
• /popup_window.php
• /squirrelcart/cart_content.php
• /squirrelcart/popup_window.php
• /store.php
• /test.php

HAH! Take that, h4x0r!

Fixed 404s

Besides the usual hax0r crud, I found and fixed these 404 errors:
/distancelearning/: symlink -> web-based-training
/helpdesk/: symlink -> services home page
(Hmmm... should I put in redirects instead?)