What's the difference between /scripts/upcp -force and not using -force? What's the difference between a forceful restart and a graceful restart?
Heres my conversation with the support people from my Host... They had to update cpanel to fix a problem I was having.
Techs: I am going to forcefully upgrade the cpanel..
David Howard: ok
David Howard: what's the difference between a forceful upgrade and an upgrade?
Techs: we use --force option
Techs: with the command
David Howard: well I know that, but why do forceful?
Techs: I changed the "cPanel/WHM Updates" in the "update config"
Techs: of WHM
Techs: and is doing an upcp
Techs: that will fix these type of issues generally..
David Howard: ok
Until recently i had never used a Linux server, as i used to have a windows server. I now have a Linux VPS
I am now at my wits end with file permission problems
I use Joomla a lot for my websites, and i also develop and program many modules and components for it, but at the moment every time i upload a module (which is a zip file with php files that is put onto the server in the right place via php) it sets the ownership to "nobody" rather than the username so i cant access it via ftp, as it says you don't have permission or the file may not exist.
Is there anyway the server can be set so it will by default set the file to have an owner name that will allow ftp access to it without me having to learn SSH Putty (which is all i have done today) or contacting my hosting company every time?
I am spending more of my time with these permission problems than doing my work, it driving me barmy!
I run a wordpress blog with apache2+mysql5+php5 in a Debian vps with 1024mb ram (plus swap).
When you read the website everything works quick and smooth, but when you have to add data to the database (edit posts, write posts, write comments) something weird happens. monitoring the system with the top and I see that, for example, as soon as an article has been posted (already got the "article posted" message in the page) the free ram goes suddenly down (some seconds) from 800mb to 0. Swapping starts and the website stops responding. in the meanwhile cpu "wa" goes high (90%++).
Typing ps aux I can see that is not mysql process's fault, actually it seems more that it's apache to cause this ram hogging, in fact an apache restart brings back tons of free ram.
# Here is entries for some specific programs # The following values assume you have at least 32M ram
# This was formally known as [safe_mysqld]. Both versions are currently parsed. [mysqld_safe] socket= /var/run/mysqld/mysqld.sock nice= 0
[mysqld] # # * Basic Settings # user= mysql pid-file= /var/run/mysqld/mysqld.pid socket= /var/run/mysqld/mysqld.sock port= 3306 basedir= /usr datadir= /var/lib/mysql tmpdir= /tmp language= /usr/share/mysql/english skip-external-locking # # Instead of skip-networking the default is now to listen only on # localhost which is more compatible and is not less secure. bind-address= 127.0.0.1 # # * Fine Tuning #
key_buffer= 64M max_allowed_packet= 16M thread_stack= 128K thread_cache_size= 8 max_connections = 600 table_cache = 256 #thread_concurrency = 10 # # * Query Cache Configuration # query_cache_limit = 1M query_cache_size = 16M # # * Logging and Replication # # Both location gets rotated by the cronjob. # Be aware that this log type is a performance killer. #log= /var/log/mysql/mysql.log # # Error logging goes to syslog. This is a Debian improvement :) # # Here you can see queries with especially long duration #log_slow_queries= /var/log/mysql/mysql-slow.log #long_query_time = 2 #log-queries-not-using-indexes # # The following can be used as easy to replay backup logs or for replication. #server-id= 1 #log_bin= /var/log/mysql/mysql-bin.log # WARNING: Using expire_logs_days without bin_log crashes the server! See README.Debian! #expire_logs_days= 10 #max_binlog_size = 100M #binlog_do_db= include_database_name #binlog_ignore_db= include_database_name # # * BerkeleyDB # # Using BerkeleyDB is now discouraged as its support will cease in 5.1.12. skip-bdb # # * InnoDB # # InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/. # Read the manual for more InnoDB related options. There are many! # You might want to disable InnoDB to shrink the mysqld process by circa 100MB. skip-innodb # # * Security Features # # Read the manual, too, if you want chroot! # chroot = /var/lib/mysql/ # # For generating SSL certificates I recommend the OpenSSL GUI "tinyca". # # ssl-ca=/etc/mysql/cacert.pem # ssl-cert=/etc/mysql/server-cert.pem # ssl-key=/etc/mysql/server-key.pem
There was a file ftpquickbrute_08.05.2008_10_47_08.log Opened it up it says:
Quote:
FTP Quick Brute (called c99shell v. w4ck1ng-shell (Private Build v0.3)) started at 08.05.2008 10:47:21
No success. connections!
------------------------------------------ Done! Total time (secs.): 3.2036 Total connections: 101 Success.: 0 Unsuccess.:101 Connects per second: 31.53
all day i receved msgs of BFD someone trying acess server, how to stop it, exemple: Executed ban command:
/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd} The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233 Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233 Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....
Today I woke up to a couple of emails from people in China and India trying to break into my server. Then as I went to login to WHM I get this message:
This account is currently locked out because a brute force attempt was detected. Please wait 10 minutes and try again. Attempting to login again will only increase this delay.
If you frequently experience this problem, we recommend having your username changed to something less generic.
Are there ways that I can prevent these attacks? I know that the IPs involved are getting banned, but are there any other methods I should be taking?
Over the last few weeks I've been getting emails from WHM stating "x login failures attempts to account root (system) -- too many attempts from this ip"
These emails have been coming in almost hourly and it seems as though somebody is trying to guess the password to the root account and random other accounts.
For now I reduced the amount of failed login attempts to 2 before cPanel blocks the IP.
Is there any other way I can completely stop this person from even attempting to guess my passwords?
For a company I'm working at, two nodes have been brute force attempted through SSH. I've got the logs from both servers in front of me, but could anyone enlighten me of who the ISP is?
I have a managed VPS and I haven't really ever paid too much attention to the logs until now.
I noticed that the APF logs indicate a 2-5 attacks on my server attempting to log in via ssh. My system allows 10 minutes of log in failure attacks before apf bans the ip.
To eliminate the method of attack, I see 2 ways. One way is to change the SSH port; the second is to only allow ssh via specified ip's.
What are the pro's and con's of both... also are there other ways to eliminate these attacks via ssh?
we're using a subdomain to point to one of our server's IP. (gaming purposes).
And people use this subdomain to connect to the game server. However, We are going to move to a new server soon with a different IP.
I know, only thing I have to do is change the IP of the subdomain to point to the new server, however I know this will take like 1 to 48 hours to fully work.
Is there a way to force people who's still connecting to the OLD Ip to go to the new IP?
And im getting the following in an email every 10 minutes:
Code: /usr/local/bfd/conf.bfd: line 26: : command not found /usr/local/bfd/conf.bfd: line 38: : command not found /usr/local/bfd/conf.bfd: line 47: : command not found /usr/local/bfd/conf.bfd: line 59: : command not found /usr/local/bfd/conf.bfd: line 60: : command not found /usr/local/bfd/conf.bfd: line 76: : command not found /usr/local/bfd/conf.bfd: line 88: : command not found The email is being sent from:
Now i know this isnt r-fx networks support but none of there support options seem to work so i figured id post here considering the amount of users that are likely to be using bfd (or you should be)
Ok, this is weird. What do you do when your VPS was submitted to a brute force attack from the U.S Department of Defense?
The IP Whois and Reverse DNS gives me "DoD Network Information Center", why in the world would they try to force access to a small (less than 20 clients) Canadian host?
And in case you're wondering, they don't seem to have any abuse email address.
How can I force sendmail to ignore it when a user sets the From: and Reply-to: headers for an email, such as a PHP script? I would like to force it so it always uses whatever email I set.
I cannot seem to find how to do this... sendmail config is quite difficult.
over the last 2 days I've gotten 11 emails telling me about brute force detections on my server, the vast majority of them are for sshd from different IP's.the number of events ranges anywhere from 11 to 515.
my server is being brute force attacked at port 22.. It caused my server to be blocked by my ISP's upstream...
at first I follow the instruction on this forum showthread.php?t=456571 (can't post link)
but then I realized (from the upstream email, I don't have access to any log on their side) that it was UDP.. not TCP.. but it was said to be brute force attack on SSH port.
Now all I do is moved ssh port.. and then limit the max connection per minute to port 22/UDP like on the above tutorial page..
Is that enough? I can't use IPTables to permit specific IPs, I'm pretty much very mobile so my own IP is different each time.
Any ideas why UDP attack?
Is it possible that brute force attack turned out to be UDP protocol? cause if it's not, then I think my ISP/its upstream can't be trusted..
We are struggling to configure our Apache reverse proxy (on WIN 2008) server to force https.
We have the cert installed on the proxy server, and it seems to be working but we are unable to force connections to https: and the site is still available via http:
How do you enforce https on the site?
reading read about the .htaccess file, virtual hosts but still having a hell of a time putting it all together
I get a lot of messages from CSF about Port Scanning and Bruteforce detection.. Is there a way to avoid all of these attacks ? Because it tries to figure out my clients ftp or pop3 user with several usernames, i.e. administrator, postgres, mysql, httpd, and many more..
I know a little about internet security.. Is it possible to make my public IP of shared hosting untraceable ? Like this one..
Just do a ping to ebay.com or paypal.com and then you will receive RTO message or Destination host unreachable, but actually the site is running well..
My issue is with my code I have it rewwrites my addon domains to the main domain. I have a addon domain exclusion line. But each time I add a domain I have to go in and edit the htaccess. I foresee lots of addon domains in my future.
