Server went to 100% Utilization

[nwoliver]

Is there any information out there on Novell servers (mine are NW 6.5) being thrown to 100% utilization when being hit by a network scan. I have a guy in here doing a network audit and he is using GFI Languard. Yesterday afternoon, right after he started scanning, my Groupwise (7.01) went to 100% for no explainable reason. I restarted it and everything settled down to normal. I then tried to hit it with a Nessus scan (with the DoS stuff turned off) and the scan immediately failed itself, telling me that NW servers have a tendency to crash when being scanned.

Any great ideas out there?

 

[gurutc]

Hi,

Ok, first you need to check what Service Pack you are running. Netware 6.5 SP5 (and earlier but if you're running earlier you have a lot more problems than this) had a version of httpstk.nlm, the HTTP Stack main code, that has security exploit issues and also major instability problems. Nessus, and evil hackers, will indeed crash the http stack, which, by the way, handles most of the non-client server communication including inter server security, the back end of groupwise, and printing control.

The update for this module, dated June 2006, is a Critical Update for Netware. You can download it by itself, or you can get SP6 which includes it.

The reason I think this will fix you is we had the exact same issue!

Good Luck,
- gurutc

 

[nwoliver]

Thanks very much. It must be an intermittent issue, because it did not crash my other servers, just the Groupwise (fortunately). I will be doing SP6 soon, but in the meantime I will be aware of the issue and make sure my scans make an exception for those boxs.

 

[gurutc]

Ok,

Just make sure you do the Post-SP6 patches when you go to SP6. There are a couple of gotchas that have been resolved.

Good Luck,
- gurutc

moderation in all things, especially moderation