Incomign DOS Attack They Black Hole My IP And All Sites Are Down
Apr 4, 2007
I just got email from the company with which I co locate my servers (one of the resellers in MPT). The email said:
"We have detected a deny of service attack on one of your IP's
69.90.xxx.xxx. The attack was approximately 200Kpps and 120Mbps. The
IP has been null routed and will be in place for 24 hours."
Now all my sites hosted on that IP are down.
Is this the way the co location companies and their upstream providers deal with DOS attacks?
Its going to harm me a lot if I have to wait for 24 hours for the
services to work.
After reading an article on command line FTP, I FTP'd to my VPS and was shocked out much access someone without logging in (and Anonymous FTP is off) has. I am running cPanel Release on CentOS 4 and Virtuozzo 3. How can I improve server security without giving any SSH access? I was all ready to use WebDav over SSL but then it doesn't allow you to change permisisons. Security is my #1 priority. My friend who I host says his clients like FTP and FTP is a standard service.
Would FTP with SSL be more secure, or still pose the same problems with sniffers and people connecting and being able to do something? Can I force FTP over SSL while not having cPanel over-ride my settings wiht an update?
What can I do to solve this major security hole? Next on my list is forcing POPs and IMAPs, authentication for SMTP and even SSL SMTP. Then only SMTP incomg 25 and HHTP port 80 would be none secure, but everything mostly secure.
My understanding is that currently the only way to protect against it is to deny any requests for PDFs where the request string takes that particular form? Is that correct? Or will the browser not even submit anything beyond the # sign in the request for the PDF?
And if it is correct.... has anyone tried to cook up a recipe that we can all dump in our .htaccess files to get this fixed up?
I got an email from our rather new VPS server (all headers seem to show it's really from our IP) where an account was created by root and deleted 30 minutes later?!
Is there a cpanel loophole?
What should we do next?
+===================================+ | New Account Info | +===================================+ | Domain: z0ne-h.com | Ip: 72.xxx.xxx.xxx (y) | HasCgi: y | UserName: vampire | PassWord: 0123969469 | CpanelMod: x | HomeRoot: /home | Quota: 10000 Meg | NameServer: ns1.xxxxxxxxx.net | Contact Email: only.vampire@gmail.com +===================================+ Account was setup by: root (root)
A client hacked another client of mine using the following Perl code:
#!/usr/bin/perl
symlink ("/home/john/public_html/config.php","/home/carole/public_html/forums/includes/config.php"); After the hacker got the DB name, username and password it's very easy to change anything in the forum using PHP.
I have just discovered a massive security in the CPANEL 10.9 software. This problem is in the BACKUP FEATURE. If you do remote ftp back onto the same account. It will put the file in the account home directory and it will have this type of stuff accountname:ROOTPASSWORD@serverhostname.com
Just an FYI - we have been monitoring some attempts from europe. Here is a file that they were trying to include using a hole in PHPCoin's URL handler:
[URL removed] stringa.txt
The attempt was coming from linux.htd-information.dk
I've come across a few of my sites on the server at my work that are showing up with Black Diamonds with question marks in them. It seems like just recently have we started having this problem, sites that have been up for a while now without these problems are now having them. What could be the cause of this so that we may look into it?
I have 20 clients who are on different networks and countries but all of the sudden their IP's are keep getting black list in spamhause, CBL, dsbl etc and they can not send email i am so very tired of this,
I have started having daily numproc black alerts on my VPS. Tech Support have increased the numproc limit already to 1500 but say that I will need a dedicated server, that's the last I have heard. I'd like to know if there is anything I can do to limit this numproc problem without the need to get a dedicated server. The numproc alerts seem to be getting more frequent but the visitors to the site are not increasing. Here are the details:
Only one site is hosted on the VPS. Includes phpbb forum & various php / mysql sections like an affiliate store & photo gallery. Averaging about 11000 visitors/day I tried to run /proc/user_beancounters & ps axv commands when the numproc was maxed this morning but could not log in to run it so these are the ones I ran yesterday.
we have a dedicatd linux server. we use to send daily newsletters to our customers but for last few days, it looks like our mail server is sending out email to client's spam folder.
Is there any way to diagnose our mail server and find out if there is anything wrong or if our mail server has been black listed?
i like the I/O panel is in the front and not the back. It can be a pain in the butt to access the back I/O panel in the DC.
I'm pretty sure the default SuperMicro panel will have to be take out but is there any motherboard that can fit this case? Did anyone try this case? Can it be bolt down by its ears? It's interesting that i don't see the blower on this case. How do you cool it?
can any1 tell me if this is ok for 3 or 4 days i was having Black and yellow zone alerts for NUMFILE on my vps, vps has 256Ram,1024 burst, using centos, virtuozzo and cpanel
I'm having the oddest issue. For some reason, some of the websites on my server load fine, and some take a really long time to load (2 minutes).
Now, the server load is fine, and the size of the sites aren't the issue either. I've restarted Apache and a couple more services, and still the same sites seem to load very slow.
What could be causing this since it's only effecting certain websites?
I'm sure that i have Trojans and Viruses on my Server but every time i contacted My Company they ask me to pay money and then they will check and scan my server
so is it any Free application which can scan and remove all bad files on my Server? i'm looking for free applications to scan the whole server
My server stop responding, I couldn't access via webmin or ssh, and DNS were not responding, so I have to ask for a reboot and now everything is fine.
Looking at the logs I found this:
Code: Jul 18 19:23:12 server sshd[18484]: Failed password for root from 61.145.196.117 port 56817 ssh2 Jul 18 19:23:12 server sshd[18485]: Failed password for root from 61.145.196.117 port 60227 ssh2 Jul 18 19:23:13 server sshd[18488]: Failed password for root from 61.145.196.117 port 38038 ssh2 Jul 18 19:23:15 server sshd[18493]: Failed password for root from 61.145.196.117 port 49884 ssh2 Jul 18 19:24:30 server sshd[18497]: Failed password for root from 61.145.196.117 port 37929 ssh2 Jul 18 19:25:06 server sshd[18521]: Did not receive identification string from 61.145.196.117 Jul 18 19:25:09 server sshd[18508]: Did not receive identification string from 61.145.196.117 Jul 18 19:25:14 server sshd[18505]: fatal: Timeout before authentication for UNKNOWN Jul 18 19:26:00 server sshd[18509]: Did not receive identification string from 61.145.196.117 And searching that IP on google I found it here: http://www.tcc.edu.tw/netbase/net/in...?fun=240&prd=3
And is flagged as a SSH Attack.
Any ideas why my server stopped working? and how to prevent it?
My site currently in prolong HTTP flood attack since 2 weeks ago. The attack was never stop and for this moment i could only mitigate the attack using my own firewall (hardware).
Since my ISP is not interested to help from upstream, even provide any mitigation services, i could only doing mitigation on my own source or using proxy services alternatively as well, but i've chose to tried on my own. I've tried once on one of well-known mitigation services out there but it seems not fully satisfied me since most of legitimate traffic is blocked from their source.
What i could do now is keep staying alive as well as will not going down on whatever situation becomes worst (but if the attack change to udp attack, i couldn't help myself coz there must be high incoming bandwidth into my network). My network is totaling 10MB last time but since this attack i've been forced to subscribe for 30MB in order to keep balance on the attack.
I've blocked all access except for my country and some other neighbours. If i change policy to allow all countries, the load of firewall will become max and after that hang will hang in less than a minute. I've done load balancing of 4 servers (8GB memory each one) and it seems the condition is getting under control with slight problem of server hang (memory shortage) and very limited keep alive connection.
Now what am i thinking is to buy a router objectively to null route incoming specific IP of countries so i can change my firewall policy to allow all connections as well as to help the firewall itself release its burden halting blocked IP that currently keep hitting itself that could might impact its performance.
Which brands of router is possible doing this thing?
Do you have some other suggestions instead of buying router?
i am just having one issue in one of my highly visited website hangibar.com, its being hosted in softlayer, we are facing synattack too much in this website.
the solution which microsoft given in their website related with tcp/ip registry entry but thing is same , some where and some connections become increases too much over tcp/ip. due to that reason website become very sticky and it stop functioning the execution of sql process, during this issue i have to restart the server to establish a fresh connection.
When i tried to view this http://gihkus.com/Lnx.txt it seems to be attack on my server. http://gihkus.com/Lnx.txt is not hosted by us. I have disabled perl support on all domains hosted on our server but still we are under attack. There is nothing special in /tmp.
Over the past day one of my servers has seen a huge rise in incomming traffic (from normal web requests to a constant 4Mbit/s, peaking upto 80Mbit/s). My outgoing traffic has remained at its normal profile, so I am pretty sure that these are not web requests, and it does not seem to be having an adverse effect on the server (the site still runs perfectly well and quick and load is still less than 1).
However, I am unsure as to how to identify what this traffic is? Are there any easy ways to tell on a FreeBSD server what the source and type of incomming traffic is? I have tried playing with netstat, but an not getting anything useful - I would like to see which ports are involved.
Am Really suffering here for ddos attack ( apache - pop3 ) every week my server under attack am using APF but now am really wanna get red from it am looking for a powerfull firewall I do not know if CSF Could stop this attack like limiting receiving SYN from an ip or any other policy another thing . i have get this rules from forums but am really weak at iptables rules so can any one help my if these rules useful or not . against Dos attack:
iptables -t nat -N syn-flood iptables -t nat -A syn-flood -m limit --limit 12/s --limit-burst 24 -j RETURN iptables -t nat -A syn-flood -j DROP iptables -t nat -A PREROUTING -i eth0 -d (dest ip) -p tcp --syn -j syn-flood
