/usr/local/bin/R ?

[noimad1]

I was looking through the /usr/local/apache/error log on one of my servers and I'm seeing this:

sh: /usr/local/bin/R: No such file or directory

Any ideas on how I can find out what or who is trying to call this script?

[cPanelMattCurry]

Hello,

I do see how that could be concerning, please post just before and after this error from the log, this will give us a better picture of what is happening.

Thank you,
Matthew Curry

[noimad1]

Hello,

I do see how that could be concerning, please post just before and after this error from the log, this will give us a better picture of what is happening.

Thank you,
Matthew Curry

Well unfortunetly there isn't much before or after. An it always seems to be different. Here is one group:



[Fri Sep 18 13:08:12 2009] [error] [client 72.208.37.233] File does not exist: /home/customer/public_html/modules/tableso<table><tr><td><![endif]--><div class="select_sub"><ul class="sub"><li><a href="/newsletters.php" title="Newsletters Home">Newsletters Home</a></li><li><a href="/newsletters.php
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
[Fri Sep 18 13:08:20 2009] [error] [client 66.249.65.60] (2)No such file or directory: File does not exist: /home/customer/public_html/valuations_print.php
[root@server:/usr/local/apache/logs]$





Here is another group:


[Fri Sep 18 11:15:58 2009] [error] [client 174.112.80.195] File does not exist: /home/customer/public_html/customer/modules/menu/side_menu3_2.css
[Fri Sep 18 11:15:58 2009] [error] [client 174.112.80.195] File does not exist: /home/customer/public_html/customer/modules/menu/top_menu/customer5_2.css
[Fri Sep 18 11:16:00 2009] [error] [client 66.249.65.60] File does not exist: /home/customer/public_html/forum/read.php?3,32788
[Fri Sep 18 11:16:16 2009] [error] [client 207.214.127.6] File does not exist: /home/customer/public_html/notified-NotifyUser-ConnectingToInternetWarning
[Fri Sep 18 11:16:16 2009] [error] [client 207.214.127.6] File does not exist: /home/customer/public_html/verify-NotifyUser-ConnectingToInternetWarning
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
sh: /usr/local/bin/R: No such file or directory
[Fri Sep 18 11:16:37 2009] [error] [client 220.133.153.169] File does not exist: /home/customer/public_html/favicon.gif

[noimad1]

I know I don't have much information on this, but do you guys have any other suggestions on where to look?

[UNIXy]

As Matthew, it does look like you need to have a good server admin look at your server. The error means that someone could have possibly used a vulnerability in one of your script to attempt to launch a program called "R." While the error shows that the attempt was unsuccessful, a successful run of the program R will not show in those logs.

I would definitely get the server checked out. To inspect the content of the file. Run this:

updatedb

Then

locate R

Open the file R for inspection.

Regards

[noimad1]

As Matthew, it does look like you need to have a good server admin look at your server. The error means that someone could have possibly used a vulnerability in one of your script to attempt to launch a program called "R." While the error shows that the attempt was unsuccessful, a successful run of the program R will not show in those logs.

I would definitely get the server checked out. To inspect the content of the file. Run this:

updatedb

Then

locate R

Open the file R for inspection.

Regards

Thanks for the info...."locate R"....that should be fun....lol

[noimad1]

Since the locate R really wasn't any help at all I decided to grep through the customers files (since they really only have one main site on the server).

I found three files that reference the "R" program. I'm looking now into what they are trying to accomplish.

It looks like the "R" program is originally designed to deal with graphs in someway.

[UNIXy]

Perhaps it's R (The R Project for Statistical Computing) as in the statistical software package. It does have graph display capabilities.

Regards