blocked.cgi ?

[ezztro]

Hello,

since 2 days, cpanel spams my email account with this info:

[Fri Sep 23 19:02:31 2005] [error] [client xxxxxxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi

xxx = Client IP

What can i do to fix this prob ? And for what is this blocked.cgi file ?

[chirpy]

Well, it's hardly spamming, it's reporting the problem to root which presumably is forwarded to you. I toulw help to see the whole email. Have you checked whether that script is there and if it is how did it get there as someone must have uploaded it and it seems they're trying to run it.

[ezztro]

Hi,

this .cgi File is not there.

Here is the email:

Unusual System Events
=-=-=-=-=-=-=-=-=-=-=
Sep 23 20:21:26 cust01 kernel: ** IN_SANITY **IN=eth0 OUT= MAC=00:0c:76:62:b0:ca:00:e0:81:24:fc:48:08:00 SRC=201.29.203.157 DST=xxx LEN=40
TOS=0x00 PREC=0x00 TTL=51 ID=47457 PROTO=TCP SPT=113 DPT=42247 WINDOW=0 RES=0x00 ACK RST FIN URGP=0
Sep 23 20:46:44 cust01 last message repeated 2 times
Sep 23 20:47:29 cust01 last message repeated 3 times
Sep 23 20:50:23 cust01 last message repeated 2 times
Sep 23 20:50:56 cust01 last message repeated 3 times
Sep 23 20:53:28 cust01 last message repeated 2 times
Sep 23 20:59:23 cust01 last message repeated 2 times
Sep 23 20:59:34 cust01 last message repeated 2 times
Sep 23 20:54:55 cust01 xinetd[15346]: START: imap pid=22036 from=xxx
[Fri Sep 23 20:01:22 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:01:22 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:01:58 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:01:58 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:02:23 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:02:23 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:02:39 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi
[Fri Sep 23 20:02:39 2005] [error] [client xxx] Options ExecCGI is off in this directory: /usr/local/apache/htdocs/blocked.cgi

[chirpy]

That's a logcheck report. The information in there is only a warning and it's most likely someone trying to browse to a domain that you no longer host but is for whatever reason still pointing to your srevers IP address. You can probably just ignore it.

[ezztro]

Ok, thank you