Hack Attempts - HELP

I'm seeing hundreds of these appearing in my log - I have the GRSecurity patch on my server, so it's blocking these, but I'm still VERY concerned. Here's what's appearing most recently:
Oct 3 18:38:26 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:27 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:27 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:28 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:28 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:28 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:28 server2 kernel: grsec: more alerts, logging disabled for 30 seconds
Oct 3 18:38:58 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:58 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:58 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:58 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:59 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:59 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:38:59 server2 kernel: grsec: more alerts, logging disabled for 30 seconds
Oct 3 18:39:29 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:39:29 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:39:29 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:39:29 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:39:29 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:39:29 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:39:29 server2 kernel: grsec: more alerts, logging disabled for 30 seconds
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:00 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (httpd:28405) UID(0) EUID(0), parent (httpd:1007) UID(0) EUID(0)....<<<<----- Full line, for an example
Oct 3 18:40:00 server2 kernel: grsec: more alerts, logging disabled for 30 seconds
Oct 3 18:40:30 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:30 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:30 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:30 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:30 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:30 server2 kernel: grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (ht$
Oct 3 18:40:30 server2 kernel: grsec: more alerts, logging disabled for 30 seconds
And here's what was happening earlier:
Oct 3 02:16:46 server2 kernel: grsec: From 209.237.238.158: attempted resource overstep by requesting 302235648 for RLIMIT_AS against limit 101009408 by (httpd:15274) UID(99) EUID(99), parent (httpd:12708) UID(99) EUID(99).... <<<<<---- Full line, for example
Oct 3 02:16:46 server2 kernel: grsec: From 209.237.238.158: attempted resource overstep by requesting 302235648 for RLIMIT_$
Oct 3 02:16:49 server2 kernel: grsec: From 207.158.138.29: attempted resource overstep by requesting 301961216 for RLIMIT_A$
Oct 3 02:16:49 server2 kernel: grsec: From 207.158.138.29: attempted resource overstep by requesting 301961216 for RLIMIT_A$
Oct 3 02:18:51 server2 kernel: grsec: From 216.142.43.54: attempted resource overstep by requesting 302309376 for RLIMIT_AS$
Oct 3 02:18:51 server2 kernel: grsec: From 216.142.43.54: attempted resource overstep by requesting 302309376 for RLIMIT_AS$
Oct 3 02:21:45 server2 kernel: grsec: From 65.95.81.114: attempted resource overstep by requesting 302141440 for RLIMIT_AS $
Oct 3 02:21:45 server2 kernel: grsec: From 65.95.81.114: attempted resource overstep by requesting 302141440 for RLIMIT_AS $
Oct 3 02:21:51 server2 kernel: grsec: From 195.224.200.135: attempted resource overstep by requesting 302149632 for RLIMIT_$
Oct 3 02:21:51 server2 kernel: grsec: From 195.224.200.135: attempted resource overstep by requesting 302149632 for RLIMIT_$
Oct 3 02:22:25 server2 kernel: grsec: From 209.157.220.197: attempted resource overstep by requesting 302268416 for RLIMIT_$
Oct 3 02:22:25 server2 kernel: grsec: From 209.157.220.197: attempted resource overstep by requesting 302268416 for RLIMIT_$
Oct 3 02:23:46 server2 kernel: grsec: From 12.247.57.160: attempted resource overstep by requesting 302309376 for RLIMIT_AS$
Oct 3 02:23:46 server2 kernel: grsec: From 12.247.57.160: attempted resource overstep by requesting 302309376 for RLIMIT_AS$
Oct 3 02:25:55 server2 kernel: grsec: From 66.55.232.203: attempted resource overstep by requesting 301961216 for RLIMIT_AS$
Oct 3 02:25:55 server2 kernel: grsec: From 66.55.232.203: attempted resource overstep by requesting 301961216 for RLIMIT_AS$
Any thoughts? The earliest attacks look like they're from random IPs, and the newest don't even have IPs attached. Even with GRSEC, I'm still concerned that something could happen.

- Matt

 

 

 

 

Top