I managed to block referrers/hotlinkers by htaccess,so images are not visible there anymore,but the problem is i still see them in access log,and it seems that causing large cpu usage of apache when checking daily cpu usage.And those loaded files even doesn't exits anymore.So is it possible to completely block them,so i can not see them in domlogs/access logs?
View 1 RepliesIf I know the IP range that I want to block the best option is to block it with IPTABLES. This works well when you want to block entire countries. But what happens when you want to block specific IPs rather than ranges? Is iptables still more effective than "deny from [IP]" in .htaccess? I read that you don't want iptables to grow too big as it slows performance, but I guess it is still more effective than having big .htaccess..?
When it comes to blocking spam bots or referrers, robots.txt is just a suggestion for bots, when I looked at my traffic logs I noticed that most bots don't even look at robots.txt file. As far as I understand the only option here is to use .htaccess
1. I am currently using this in my .htaccess:
SetEnvIfNoCase User-Agent *ahrefsbot* bad_bot=yes
SetEnvIfNoCase Referer fbdownloader.com spammer=yes
...
SetEnvIfNoCase Referer social-buttons.com spammer=yes
Order allow,deny
Allow from all
Deny from env=spammer
Deny from env=bad_bot
2. Apparently, there is another approach as per below:
# Deny domain access to spammers
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} queryseeker [OR]
RewriteCond %{HTTP_REFERER} ^(www.)?.*(-|.)?adult(-|.).*$ [OR]
...
RewriteCond %{HTTP_REFERER} ^(www.)?.*(-|.)?sex(-|.).*$
RewriteRule .* - [F,L]
Which approach is better #1 or #2? Any better alternative?
Finally, somebody suggested that you need to have both (as per example below). Is it true?
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^rogerbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^exabot [OR]
RewriteCond %{HTTP_USER_AGENT} ^MJ12bot [OR]
[Code] ....
Just thought I would post up a review on what I thought about SolarVPS, as I've had nothing but joy with them.
It was back in 2007 when I decided that shared hosting was getting to slow for my website, and I was advised to get a VPS plan. I was originally with Bluehost, who provided outstanding customer service and value for money, and I was very reluctant to move from them. My worry was that I would move to a service where I was pretty much neglected, and left with 0 support, and many server issues.
However I came across SolarVPS on these forums, and gave them a go. Well I used the lifetime discount voucher, so my package was pretty cheap as it was. My server was setup instantly after payment, and things have been going fine since.
I've recently started up a new project, and needed a new VPS hosting package. So I came along to these forums again today to look for some juicy VPS deals. Came across a fair few, some which did seem very good value for money, but the issue about customer service was bugging me. What if the CS was delayed, what if my support tickets were not addressed, and what if their live chat was only live a few hours in the day. After finding some good deals, I thought hell with it, I'l get another plan with SolarVPS.
So I found their nice 20% off coupon which I applied to my account, making the pan I bought again, pretty good value for money. Bought the plan, immediately received some emails regarding my purchase. I went to the live chat and was talking to one guy, Douglas, about setting my server up. It's the one time that I've felt I was talking to a human via live chat. Not only did this guy sort me out in a snap, but he had a great sense of humour to which is always a bonus.
So, within an hour, I now have a nice new plan setup with SolarVPS that I KNOW I will be pleased with.
Let me just gloss over the points about SolarVPS I think really stand out: ....
As per the title, what steps are needed to remove HyperVM altogether from the server leaving just the OpenVZ or Xen kernels?
View 6 Replies View RelatedIs there any way to have sendmail completely disabled on my server?
I tried:
service sendmail stop
but my maillog keeps filling up with a lot of messages like these:
stat=Deferred: Connection refused by [127.0.0.1]
How can I stop the maillog from filling up?
I've removed a website from my server, terminated the account, removed all files. But when you go to the domain name, you get the "Great Success ! Apache is working on your cPanel® and WHM™ Server" page. I dont want even that. I want nothing to come up.
I want it to appear as if the domain/server never existed and show up as a 404 or whatever (this was a forced remove). Is there any way to do this? is there something I didnt do? Or am I stuck since the domain is still pointed at my server.
I've tried to give the hint (move), but it hasnt worked, so I have a feeling I'm going to get questions about this new issue. It's a church related group (even thought theyve been warned this was coming), so its hard to be an AHole, but they need to go.
I just want it to come up as if it never existed on my server, if possible.
The most common way is tar the whole files and downlaod it. But as there's also mysql DB. The common way is usually take a lot of time to restore it.
View 2 Replies View RelatedI tried searching around but maybe someone can steer me in the right direction.
I, as probably many other people, are in an interesting predicament.
I love my VPS right now...however obviously since I started with my VPS I'm about to out grow it, with the amount of power that I need.
What I'm looking for is a server which is completely managed, completely secured (some sort of active virus scanning), however I can get in there and have complete control like I would with my VPS, but obviously with more resources.
What I'm looking for is:
2-4GBs of ram
Pentium D (minimum) up to a Xeon 3220 SINGLE processor
1000 - 2000TB / bandwidth
100mb/s uplink
Windows 03 would be great, I'll settle for CentOS though
Budget max is $170/mo.
We are using Apache 2.4.7 as Reverse Proxy & Using only for Single sign on. At random times our server crashes (every 1/2 weeks) in our environment.
Find the code that we put in httpd.conf file ....
Is there any way to forbid plesk panel to use one of the IP addresses?If I remove address from panel - it has removed physically from network interface. I want to keep this IP address on network interface, but not let plesk panel use this address in all config files (nginx. apache, ssl etc.)
I want to use standard ports (443 and 80) on this IP address with some custom program not related to plesk panel and web servers. But now Plesk binds all available IP addresses to it services by default.
I felt the extreme and desperate need to post my experience with Limestone Networks here with the rest of you. Please take time to review it as I find it a vital piece of information when making a decision. I normally don't post my problems here, but this time it's needed.
I have been a customer since 5/17/2008. I was able to get someone via Live Chat when I fist went to the website. I got an instant response on the phone. It all seemed great. The server was up and online within a few hours, I was pleased. The network seemed fine and I'm fairly low maintenance, so I didn't have many complaints.
After having the account for a while, we started getting blacklisted on spam lists. I would submit tickets to see if they could work to get us removed. Typically support tickets where answered fairly slowly - I'd see a response time of a day or two. I didn't complain as I can accept things fairly well.
Next, they released a new server that was almost identical to the one I already had.
They both had the same amount of memory, similar cpus (both quad core), the only difference was one 750 GB drive vs RAID-1 750 GB drives. The price for my system was $249/month, while the new server was priced at like $130/m (the WHT special they just ran). I asked about a price adjustment for my server. They wouldn't do it. So, I asked if we could keep our IP addresses if we moved to another server. They couldn't do that either.
I ordered the new server and moved my customers over to it. It came time to cancel the old server, so I submitted my request for cancellation. I know they automatically bill everything, so I removed my credit cards that were on file to avoid this. I was then told I needed to give a 5 day cancellation notice as per my ToS when I signed up. Unfortunately, I didn't read the ToS close enough - my fault. Somehow they ended up removing the server and I guess they just waived the 5 day notice. I never really got any response on that (or bill for it either).
As of yesterday, I've had the new server for one month. I signed up for it on 7/30, so that'd make my next billing date 8/30. I did forget to add my credit cards back on so it could be auto charged again - my fault. However, less than 24 hours after my due date, I find my server is offline. I submitted a ticket which I will paste below. Bottom line, because I was late (not even by one day), they shut off and reformatted my server. Here's my support ticket:
---------------------------------------------------------
My server LSN-D1595 is offline due to non payment. I need it back online asap! I will add a payment option to the billing system which you can charge. Just get the server back online please. ***-***-**** if you need to reach me.
Ryan G. - Support Technician - Limestone Networks Employee
Posted: 08/31/2008 10:52 AM CDT
Hi Breck, Unfortunately your servers have been canceled for non-payment. If you wish to purchase new servers with us you can still go ahead and do so, however I am not able to return your original servers to you.
Breck B.
Posted: 08/31/2008 11:11 AM CDT
Ryan, this is completely unacceptable. I am not going to tolerate this! That server has valuble data on it that can't be recovered! I don't care what your policy is, I need that server back online immediately! If you can't make this right, I will be posting my experience on WHT. Bill me hourly if you need to. Just get it online.
Bryan P. - Support Technician - Limestone Networks Employee
Posted: 08/31/2008 01:19 PM CDT
I'm sorry, but server LSN-D1595 has already been reformatted.
Bryan P. - Support Technician - Limestone Networks Employee
Posted: 08/31/2008 02:17 PM CDT
Closed Ticket
---------------------------------------------------------
So, there we have it. My server has been reformatted because I'm a day late. I've never seen anything like this in my entire life. Money wasn't a problem - I was away and just wanted to have a good Labor Day weekend. Also, I NEVER received an invoice via email, snail mail, nor a phone call. I got no notice at all. Along with that, according to their ToS, my data should be available within 15 days of my non payment (whether or not the server is).
I do plan on taking this to court- I have several people who also had access to the server who are interested in a lawsuit.
If slow responses, being blacklisted on spam databases, and being reformatted if you are under 24 hours late is okay with you - I'd really recommend Limesone Networks! They give you a great feeling like nobody cares about you. I'm not sure why a company would invest so much money in advertising, if they really aren't serious about keeping the customers that they get. This has been the worst day of my life. I hope all of you can get something from this and learn to stay away from companies like Limestone. I definately have learned my lesson the hard way.
is there any way to disable automatic updates completely ? Because the lowest option in the panel is:
"Notify me about available updates but do not automatically install them" (Critical security updates will still be installed automatically.)
And while I can't figure out, which files are going to be updated even on this minmalistic setting, I have to disable it completely.
I've encountered a curious problem. Fresh install of Plesk 11 on a Windows 2008 R2 Server. If I want to configure FTP-Accounts under "Domain&Mail" the option is missing entirely. The Server is running an FTP Server and I can connect via FTP to some parts with some users I have created in Plesk. I've scrounged the internet for information about what might be going on here but came up empty.
There is no option to configure FTP Accounts or anything FTP in Plesk. There is empty space where the link should be.
I have an issue with my daily backup. I configured to have a daily backup on an external FTP server. Everything looks to work correctly but in the panel I see that the task is a 100% forever. Never finishing completely.. So the next day, the task is not starting.. I have to remove manually the task in backup manager screen.
here is the last lines of the log file (in /var/log/plesk/PMM/backup-2015-01-20-20-46-02-824)
[2015-01-20 21:33:53.108|18485] INFO: ENV[LANG]=en_US.UTF-8
[2015-01-20 21:33:53.108|18485] INFO: Executing utility: /bin/sh -c -e /bin/tar --create --file /usr/local/psa/PMM/tmp/backupznMOWN/daily__1501202046.tar --directory /tmp/repo_transport_tmp_Jalkfn/ --dereference --files-from /tmp/repo_transport_tmp_UTCFhv
[2015-01-20 21:41:12.528|18485] INFO: The utility executed with the return code 0
[Code] ....
We will be hosting our own closed source solutions and need to be able to not give customers access to the files in their webspace.FTP and SSH access will be blocked in the firewall, so that it easy.I see it is possible to disable access to FTP users information, but the file manager is still usable in the CCP (Customer Control Panel / Hosting Panel).Can this file manager be disabled as well?
View 6 Replies View RelatedI'm suffer 2 major problem as below :
1.
how to turn off spamassassin completely ?
I've already stop the spamassassin service on Services Management but it's only valid one day. The next day, spam assassin service automatically start
2.
my customer mailbox statistic wrong. Even if their mailbox not full but when they send email. The quota said that their mailbox full. So they can't send/receive email.
Our action :
Manually, use command
/usr/local/psa/bin/sw-engine-pleskrun /usr/local/psa/admin/plib/DailyMaintainance/script.php -f execute-statistics
I am curious, what is the best way to ban certain IP from accessing server? I have software firewall (APF) and there is, of course, /etc/hosts.deny.
Which is the most efficient? I've read that software firewall becomes unstable after so many entries. Does the same apply to /etc/hosts.deny file?
Or is there a better way altogether?
some Chinese forums hotlinking images from my site and I even delete those images they keep sending me huge amount of http requests to my hosting server and eating 800mb of memory and upto 1GB cause server crash
I tried to block incoming referrer traffic from those sites using htaccess but it didn't work , I still see their http request on my server logs and memory keep goes high , am not sure my code is the right
how can I block these http request from these domains , what is the right htaccess code , I use DirectAdmin panel by the way
Can any one let me know how to block a range IP on SSH?
Eg: i'd like to block all IP: 67.63.123.xxx
I'm currently experiencing a lot of IP's starting with 200 and 201 (from Brazil) some IP’s have over 200 connections. I have APF installed and want to know how to block a block on ip's if this is possible.
IPS:
200.11.*******
201.*******
I have DDos Attack right now so I want to block all the IP from all over the world and just allow certain IP range.
How to do it using APF or any other way.
For example I want to block everything but Germany IP
Code:
53.0.0.0/8
62.4.64.0/19
62.8.32.0/19
62.8.128.0/17
62.24.0.0/19
62.26.0.0/15
62.40.0.0/19
62.44.32.0/19
62.48.64.0/19
62.50.32.0/19
62.50.96.0/19
62.50.192.0/18
62.52.0.0/14
62.61.32.0/19
62.68.0.0/19
62.72.0.0/18
62.72.64.0/19
62.75.128.0/17
62.78.64.0/20
62.80.0.0/18
62.80.96.0/19
62.89.160.0/19
62.91.0.0/16
62.93.192.0/18
62.95.128.0/18
62.104.0.0/16
62.109.64.0/18
62.109.128.0/19
62.111.0.0/17
62.112.32.0/19
62.112.64.0/19
62.112.128.0/19
62.116.128.0/18
62.117.0.0/19
62.128.0.0/19
62.128.160.0/19
62.133.0.0/19
62.138.0.0/16
62.141.32.0/19
62.141.160.0/19
62.145.0.0/19
62.143.0.0/16
62.144.0.0/16
62.146.0.0/16
62.152.0.0/19
62.152.160.0/19
62.153.0.0/16
62.154.0.0/15
62.156.0.0/14
62.165.0.0/19
62.168.192.0/19
62.169.0.0/19
62.176.128.0/19
how can i block to access to some IP?
for examaple scripts in my hosts can not access to some IPs i want
Fortigate appliances blocking an IP that is not in RBLs I have a problem with the IP 66.187.108.157 of my VPS it seems to be blocked by Fortigate appliances, as you can see in this error message:
SMTP error from remote mail server after RCPT TO:[url] host mail.am.com.pe [200.62.221.107]: 554 5.7.1 This message has been
blocked because it is from a FortiGuard - AntiSpam black IP address.(connection black ip 66.187.108.157)
However I have searched in this URL [url]and it is clean.
Any ideas on how to have/force Fortigate databases to become updated.
I'm having difficulties with a whm running on centos dedicated server. The problem is that we receive too much of spam and junk emails. by too much I mean 2000 bulks per week. It's killing us.
how I can stop it.
IM about tired of spam and hackers putting phishing items on my server.
My question is.
How can I block the whole world expect for US, CA and UK?
I've added several countrys to csf's csf.deny list but half of them keep disappearing.
Is there any way to block a particular ISP? Have a visitor that changes IP hourly, but the IP always resolves back to a hostname like dsl.yuns.sksk.uk .
I have CSF installed. Any way to block all visitors from dsl.yuns.sksk.uk?
in one of my servers i have this line in my ConfigServer Security & Firewall:
190.28.118.155 # lfd: 10 (suhosin) login failures from 190.28.118.155 - Mon Jun 16 23:27:50 2008
is this ok? i mean... its an attack of some sort? i know suhosin is meant to increase php security, so its blocking an attack right?
I have blocked this IP 125.115.144.28
/etc/apf/apf -d 125.115.144.28
But
netstat -anp|grep tcp|awk '{print $5}'| cut -d : -f1 | sort | uniq -c | sort -n
It still showing
202 125.115.144.28
Why?
Is it supposed to blocked right away, or need some time to get blocked.
When I checked /etc/apf/deny_hosts.rules
The IP is in the file.
I set up a forum for a small group of users, so I don't really wish to see spiders or bots on it, so I've put a robots.txt file there to prevent all of them from accessing the forum pages.
I know not all bots follow the robots.txt rule, and these days a really annoying bot called MUNAXNET or Munax AB with IP range 82.99.30.0 - 82.99.30.127 is causing the forum to have extra and unexpected loads.
I've tried to block this IP range with .htaccess and uploaded it to the root of the site a few days ago, here is the content:
<Limit GET HEAD POST>
order allow,deny
deny from 82.99.30.0-82.99.30.127
allow from all
</LIMIT>
However strangely it seems that all of these are not working for this bot, today I saw my forum had 80 users online and that army still keeps coming and browsing all pages of my forums...
I tested the .htaccess with blocking myself, and it actually worked for me, dunno why it's not working for that bot..
I was just researching my log analyzers to see whats happening... I noticed something new in the logs, a large number of unnamed robots or spiders... so I found the robot... it was this:
23310 7.99% 23303 9.48% 1159765 18.56% 22 0.12% 77.88.26.26
After some reading, sites say the ip belongs to spider26.yandex.ru
For simply security reasons, would it be in best interest to block the entire subnet? It seems that the same IP ending in .25 belongs to spider25.yandex.ru