We ran across an unusually message on the Logger screen of a Netware 6.5 sp7
server that we use for training.

The message is wedged between 2 other apache errors that we're also looking
into (although the classes are able to do everything and haven't reported
any issues).

The message is:
@@@@@@@@@@@NO SSL NO SSL lalala@@@@@@@@@@@@@

At first we were thinking that the server was compromised --- but then
someone suggested that maybe its a developer code message. (???) We're
leaning more towards a hack, but we thought we'd post anyways --- see if
anyone has any insights.

The server doesn't appear to have any other signs of compromise (although it
does sit outside of our firewall) as its used for alot of remote training.
We've scanned the entire sys volume for any files containing "lalala" and
have come up empty. Nothing hidden in edir, no bogus files, nothing....

The full logger.txt file including the above lalala message is below.

Thank you for any insights that anyone can offer!!!


Dec 9, 2008 7:09:36 PM org.apache.jk.server.JkCoyoteHandler action
INFO: Response already commited
Dec 9, 2008 7:09:36 PM org.apache.jk.server.JkCoyoteHandler action
INFO: Response already commited
Dec 9, 2008 7:09:37 PM org.apache.jk.server.JkCoyoteHandler action
INFO: Response already commited
::shouldShow::-----Enter-----
NovellLDAPAuthenticator::KeyStorePAth:: SYS:\JAVA/lib/security/cacerts
LDAPException: Unable to connect to server <server IP address removed>:636
(91) Connect Erro
r
java.net.ConnectException: Connection refused
at com.novell.ldap.Connection.connect(Unknown Source)
at com.novell.ldap.Connection.connect(Unknown Source)
at com.novell.ldap.LDAPConnection.connect(Unknown Source)
at
com.novell.nps.kerberos.NovellLDAPAuthenticator.lo gin(NovellLDAPAuthe
nticator.java:127)
at
com.novell.nps.kerberos.KrbModifyPrincipalPage.sho uldShow(KrbModifyPr
incipalPage.java:141)
at
com.novell.emframe.dev.DirPropertyBook.addPage(Dir PropertyBook.java:8
46)
at
com.novell.emframe.fw.ModifyObjectTask.instantiate Pages(ModifyObjectT
ask.java:106)
at
com.novell.emframe.dev.PropertyBook.initialState(P ropertyBook.java:31
1)
at
com.novell.emframe.dev.PropertyBook.execute(Proper tyBook.java:142)
at com.novell.emframe.dev.Task.execute(Task.java:505)
at
com.novell.nps.gadgetManager.BaseGadgetInstance.pr ocessRequest(BaseGa
dgetInstance.java:849)
at
com.novell.nps.gadgetManager.GadgetManager.launchG adget(GadgetManager
..java:4332)
at
com.novell.nps.gadgetManager.LaunchService.onLaunc hAction(LaunchServi
ce.java:190)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Nativ e Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(Native MethodAccessorImpl.
java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(De legatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at
com.novell.nps.gadgetManager.BaseGadgetInstance.ha ndleAction(BaseGadg
etInstance.java:2362)
at
com.novell.nps.gadgetManager.GadgetManager.process InstanceRequest(Gad
getManager.java:1606)
at
com.novell.nps.gadgetManager.GadgetManager.process ServiceRequest(Gadg
etManager.java:1062)
at
com.novell.nps.PortalServlet.handleFrameService(Po rtalServlet.java:50
5)
at
com.novell.nps.PortalServlet.processRequest(Portal Servlet.java:373)
at com.novell.nps.PortalServlet.doPost(PortalServlet. java:279)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:709)
at
com.novell.emframe.fw.servlet.AuthenticatorServlet .service(Authentica
torServlet.java:322)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:802)
at
org.apache.catalina.core.ApplicationFilterChain.in ternalDoFilter(Appl
icationFilterChain.java:252)
at
org.apache.catalina.core.ApplicationFilterChain.do Filter(ApplicationF
ilterChain.java:173)
at
org.apache.catalina.core.StandardWrapperValve.invo ke(StandardWrapperV
alve.java:214)
at
org.apache.catalina.core.StandardValveContext.invo keNext(StandardValv
eContext.java:104)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:520)
at
org.apache.catalina.core.StandardContextValve.invo keInternal(Standard
ContextValve.java:198)
at
org.apache.catalina.core.StandardContextValve.invo ke(StandardContextV
alve.java:152)
at
org.apache.catalina.core.StandardValveContext.invo keNext(StandardValv
eContext.java:104)
at
org.apache.catalina.authenticator.AuthenticatorBas e.invoke(Authentica
torBase.java:540)
at
org.apache.catalina.core.StandardValveContext.invo keNext(StandardValv
eContext.java:102)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:520)
at
org.apache.catalina.core.StandardHostValve.invoke( StandardHostValve.j
ava:137)
at
org.apache.catalina.core.StandardValveContext.invo keNext(StandardValv
eContext.java:104)
at
org.apache.catalina.valves.ErrorReportValve.invoke (ErrorReportValve.j
ava:118)
at
org.apache.catalina.core.StandardValveContext.invo keNext(StandardValv
eContext.java:102)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:520)
at
org.apache.catalina.core.StandardEngineValve.invok e(StandardEngineVal
ve.java:109)
at
org.apache.catalina.core.StandardValveContext.invo keNext(StandardValv
eContext.java:104)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:520)
at
org.apache.catalina.core.ContainerBase.invoke(Cont ainerBase.java:929)

at
org.apache.coyote.tomcat5.CoyoteAdapter.service(Co yoteAdapter.java:16
0)
at
org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyo teHandler.java:300)

at
org.apache.jk.common.HandlerRequest.invoke(Handler Request.java:374)
at org.apache.jk.common.ChannelSocket.invoke(ChannelS ocket.java:743)
at
org.apache.jk.common.ChannelSocket.processConnecti on(ChannelSocket.ja
va:675)
at
org.apache.jk.common.SocketConnection.runIt(Channe lSocket.java:866)
at
org.apache.tomcat.util.threads.ThreadPool$ControlR unnable.run(ThreadP
ool.java:684)
at java.lang.Thread.run(Thread.java:534)
Caused by: java.net.ConnectException: Connection refused
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.PlainSocketImpl.doConnect(PlainSocketImpl .java:310)
at
java.net.PlainSocketImpl.connectToAddress(PlainSoc ketImpl.java:176)
at java.net.PlainSocketImpl.connect(PlainSocketImpl.j ava:163)
at java.net.Socket.connect(Socket.java:464)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.connect (DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.<init>( DashoA12275)
at
com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl. createSocket(DashoA
12275)
at com.novell.ldap.LDAPJSSESecureSocketFactory.create Socket(Unknown
Sour
ce)
... 54 more
@@@@@@@@@@@NO SSL NO SSL lalala@@@@@@@@@@@@@
Problem creating initial context:javax.naming.AuthenticationException:
[LDAP: er
ror code 49 - NDS error: failed authentication (-669)]
javax.naming.AuthenticationException: [LDAP: error code 49 - NDS error:
failed a
uthentication (-669)]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.jav a:2988)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCt x.java:2934)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCt x.java:2735)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:264 9)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:290)
at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapC txFactory.java:175)

at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Ldap CtxFactory.java:193
)
at
com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstanc e(LdapCtxFactory.ja
va:136)
at
com.sun.jndi.ldap.LdapCtxFactory.getInitialContext (LdapCtxFactory.jav
a:66)
at
javax.naming.spi.NamingManager.getInitialContext(N amingManager.java:6
62)
at
javax.naming.InitialContext.getDefaultInitCtx(Init ialContext.java:243
)
at javax.naming.InitialContext.init(InitialContext.ja va:219)
at javax.naming.InitialContext.<init>(InitialContext. java:195)
at
javax.naming.directory.InitialDirContext.<init>(In itialDirContext.jav
a:80)
at
com.novell.application.configadmin.JndiAccessBean. createInitialContex
t(Unknown Source)
at org.apache.jsp.login_jsp._jspService(login_jsp.jav a:183)
at
org.apache.jasper.runtime.HttpJspBase.service(Http JspBase.java:92)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:810)
at
org.apache.jasper.servlet.JspServletWrapper.servic e(JspServletWrapper
..java:162)
at
org.apache.jasper.servlet.JspServlet.serviceJspFil e(JspServlet.java:2
40)
at org.apache.jasper.servlet.JspServlet.service(JspSe rvlet.java:187)
at javax.servlet.http.HttpServlet.service(HttpServlet .java:810)
at
org.apache.catalina.core.ApplicationFilterChain.in ternalDoFilter(Appl
icationFilterChain.java:199)
at
org.apache.catalina.core.ApplicationFilterChain.do Filter(ApplicationF
ilterChain.java:145)
at
org.apache.catalina.core.StandardWrapperValve.invo ke(StandardWrapperV
alve.java:210)
at
org.apache.catalina.core.StandardPipeline$Standard PipelineValveContex
t.invokeNext(StandardPipeline.java:596)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:433)
at
org.apache.catalina.core.ContainerBase.invoke(Cont ainerBase.java:955)

at
org.apache.catalina.core.StandardContextValve.invo ke(StandardContextV
alve.java:139)
at
org.apache.catalina.core.StandardPipeline$Standard PipelineValveContex
t.invokeNext(StandardPipeline.java:596)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:433)
at
org.apache.catalina.core.ContainerBase.invoke(Cont ainerBase.java:955)

at
org.apache.catalina.core.StandardContext.invoke(St andardContext.java:
2460)
at
org.apache.catalina.core.StandardHostValve.invoke( StandardHostValve.j
ava:133)
at
org.apache.catalina.core.StandardPipeline$Standard PipelineValveContex
t.invokeNext(StandardPipeline.java:596)
at
org.apache.catalina.valves.ErrorDispatcherValve.in voke(ErrorDispatche
rValve.java:119)
at
org.apache.catalina.core.StandardPipeline$Standard PipelineValveContex
t.invokeNext(StandardPipeline.java:594)
at
org.apache.catalina.valves.ErrorReportValve.invoke (ErrorReportValve.j
ava:117)
at
org.apache.catalina.core.StandardPipeline$Standard PipelineValveContex
t.invokeNext(StandardPipeline.java:594)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:433)
at
org.apache.catalina.core.ContainerBase.invoke(Cont ainerBase.java:955)

at
org.apache.catalina.core.StandardEngineValve.invok e(StandardEngineVal
ve.java:127)
at
org.apache.catalina.core.StandardPipeline$Standard PipelineValveContex
t.invokeNext(StandardPipeline.java:596)
at
org.apache.catalina.core.StandardPipeline.invoke(S tandardPipeline.jav
a:433)
at
org.apache.catalina.core.ContainerBase.invoke(Cont ainerBase.java:955)

at
org.apache.coyote.tomcat4.CoyoteAdapter.service(Co yoteAdapter.java:15
7)
at
org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyo teHandler.java:200)

at
org.apache.jk.common.HandlerRequest.invoke(Handler Request.java:283)
at org.apache.jk.common.ChannelSocket.invoke(ChannelS ocket.java:773)
at
org.apache.jk.common.ChannelSocket.processConnecti on(ChannelSocket.ja
va:703)
at
org.apache.jk.common.ChannelSocket$SocketConnectio n.runIt(ChannelSock
et.java:895)
at
org.apache.tomcat.util.threads.ThreadPool$ControlR unnable.run(ThreadP
ool.java:684)
at java.lang.Thread.run(Thread.java:534)