I took server from Soft Layer
After four month they banned my account, When I talked to them they said we banned your account for tow days because we Suspicion about you and I waited them for tow days but nothing new, after that I sent all my evidences to them, the passport picture, driver's license, ID's card and Visa Card picture from front and back.
NOW!
I don't know the reason for banned my account, why they banned me?
You can see my servers information at the bottom.
If in this post there is security information I have reveiled I hope you will tell me
After a couple of hours where someone tried to login to root and Directadmin using ssh, i closed ssh and made some minor changes to the security.
I turned on the automatic add ip if login failed 3 times, in DirectAdmin.
I dont know why I was banned cause I DID NOT use wrong login???
My other users of the server also got banned, and they say they did not use wrong pass either?
SO how do I unban me so I can acces DirectAdmin again?
And as if that was not enough, because Im soooo good at this...
while I was at it I stopped SSL cause I got following error and I dont really need it, I think
-------------------------STARThttpd_error_log
[Sat Dec 15 03:38:22 2007] [error] server reached MaxClients setting, consider raising the MaxClients setting
[Sat Dec 15 03:58:32 2007] [notice] caught SIGTERM, shutting down
[Sat Dec 15 03:58:34 2007] [warn] RSA server certificate CommonName (CN) `localhost' does NOT match server name!?
[Sat Dec 15 03:58:34 2007] [warn] RSA server certificate CommonName (CN) `localhost' does NOT match server name!?
[Sat Dec 15 03:58:34 2007] [warn] Init: SSL server IP/port conflict: www.belove.updownloading.com:443 (/usr/local/directadmin/data/users/belove/httpd.conf:48) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:34 2007] [warn] Init: SSL server IP/port conflict: www.fusion-planet.updownloading.com:443 (/usr/local/directadmin/data/users/iceangel89/httpd.conf:48) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:34 2007] [warn] Init: SSL server IP/port conflict: www.nicheserver.com:443 (/usr/local/directadmin/data/users/nicsad/httpd.conf:48) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:34 2007] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:34 2007] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sat Dec 15 03:58:34 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sat Dec 15 03:58:34 2007] [warn] module php5_module is already loaded, skipping
[Sat Dec 15 03:58:35 2007] [warn] RSA server certificate CommonName (CN) `localhost' does NOT match server name!?
[Sat Dec 15 03:58:35 2007] [warn] RSA server certificate CommonName (CN) `localhost' does NOT match server name!?
[Sat Dec 15 03:58:35 2007] [warn] Init: SSL server IP/port conflict: www.belove.updownloading.com:443 (/usr/local/directadmin/data/users/belove/httpd.conf:48) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:35 2007] [warn] Init: SSL server IP/port conflict: www.fusion-planet.updownloading.com:443 (/usr/local/directadmin/data/users/iceangel89/httpd.conf:48) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:35 2007] [warn] Init: SSL server IP/port conflict: www.nicheserver.com:443 (/usr/local/directadmin/data/users/nicsad/httpd.conf:48) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:35 2007] [warn] Init: SSL server IP/port conflict: localhost:443 (/etc/httpd/conf/extra/httpd-vhosts.conf:38) vs. www.tokyolondon.net:443 (/usr/local/directadmin/data/users/tokyo/httpd.conf:48)
[Sat Dec 15 03:58:35 2007] [warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!
[Sat Dec 15 03:58:35 2007] [notice] Apache/2.2.6 (Unix) mod_ssl/2.2.6 OpenSSL/0.9.8b DAV/2 PHP/5.2.4 configured -- resuming normal operations
[Sat Dec 15 03:58:48 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sat Dec 15 03:58:49 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sat Dec 15 03:59:10 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sat Dec 15 03:59:11 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sat Dec 15 03:59:12 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
-------------------------END httpd_error_log
I have also posted this on DirectAdmin's forum, but because Im really nervous and dont know when they will answer I posted here too, cause this forum is used more
Server configuration
Linux CentOS5 DirectAdmin
Processor Name Intel(R) Xeon(R) CPU 3050 @ 2.13GHz
Vendor ID GenuineIntel
Processor Speed (MHz) 2133.507
Processor Name Intel(R) Xeon(R) CPU 3050 @ 2.13GHz
Vendor ID GenuineIntel
Processor Speed (MHz) 2133.507
Total Memory 2075520 kB
Free Memory 57004 kB - (Every time I cant access the websites, it is this low, then when I can access the websites again its
around 500mb)
Total Swap Memory 4192956 kB
Free Swap Memory 4192888 kB
Apache 2.2.6 Running
DirectAdmin 1.31.0 Running
Exim 4.67 Running
MySQL 5.0.45 Running
Named 9.3.3rc2 Running
ProFTPd 1.3.1 Running
sshd *** Stopped *** (I stopped it because my websites dont need it, in logs I could see that some sites, I dont know, were trying to acces it?)
vm-Pop3d 1.1.7f-DA-2 Running
I've an interesting issue here. A client of mine was apparently banned from one of my servers and the problem has been narrowed down to the APF. What's odd is that he's not listed on /etc/apf/deny_hosts.rules file, nor is his IP blocked by iptables.
But, as soon as the APF is enabled he can't access anything on the server! This is very random, I've been using APF for just over a year now and I've never had a problem like this. But who's to say it's not happening to others as well?
I can't seem to access my server. I can get in through a proxy but not with my own IP. I can't log in through SSH to find out what's going on because I'm banned. I manage my own machines at the moment, so no I can't really contact my host.
View 14 Replies View RelatedSince some days I have a problem with apf: It can't BAN one of the Ip from file deny_hosts.rules. Other IP's are correctly banned. Of course in apf log are:
apf(28474): {trust} deny all to/from 88.84.141.233
but this ip still have access to my server and scan my ports. I have this problem after editing internals/rab.ports (I added some ports to RAB_PSCAN_LEVEL_2). I don't know how can I fix this problem.
Topic should have title: APF can't block one of the banned IP.
My story starts with my getting burned by fumiNET (the first *grrr*)...
Burstnet reactivates my server (for an additional payment of course). The server seems fine but I thought that I might do better with a BurstNET reseller (better service). So...
I sign up with a reseller, and since I got my new server I've been plagued with email bounces, rejections, etc. Seems that my server (via the reseller) was supplied with a bunch of banned IPs (in other words, crap IPs). (the second *grrrr*)
I've reported to the providers abuse department, but was told that I have to handle this. (third *grrrr* - or is it just continued from the second?)
I've had it. I'm ready to fold up shop. As it is the sites keep me busy - but then...
- I get screwed by fumiNET (losing a big chunk of money)
- the hassle of trying to get my fumiNET server back up (thanks BurstNET)
- transferring to the reseller for better service, and finding out that perhaps BurstNET service was better than the reseller's
I'm open if anyone has suggestions. Some that I've come up with myself...
- finding yet another server provider (recommendations welcome)
- drinking large quantities of Guinness (worth it regardless)
- pulling the plug on the server and getting shared hosting to hold some minimal content
- forgetting the whole damn thing and getting a job as a [pick one]: store clerk, street cleaner, used car salesman
How can make a cronjob for remove banned ip with CSF every 15min?
View 4 Replies View RelatedHave been receiving the following warnings for more than a day. Does BFD auto execute a permanent ban or do I have to do it myself? If so, how? Also, I did a whois, found out the service provider, and sent an email regarding abuse. I have yet to receive a reply.
I was wondering since its a HK IP, do I have to send the message in chinese? Would anyone be kind enough to do so?
Quote:
Banned the following ip addresses on Thu Sep 13 16:32:01 SGT 2007
203.186.163.31 with 308 connections
I have found a host already ...
View 3 Replies View RelatedI run an small social netwroking web site.
I just checked and it looks like yahoo dont accept emails from my server.
so is there any way i send those bulk emails to those users or my web site from another mail service prodider so that delivery guaranted?
informing my users who has yahoo mail account about updates etc..
i have dedicated server and cpanel.
I just lost access to my site, but wannabrowser & siteuptime, etc. all said it was up!
I ran ipconfig /flushdns and everything.
Finally, I unplugged my wireless & router and waited. Plugged it back in, everything worked (I had a new IP)
The only suggestion I can come up with is that my own security protection filtered me! How can I view the nodos blacklist to see if this is the case?
I already checked iptables -L and my IP (and range) did not show.
when you add a banned ip to APF it doesnt show anything when the user visits the site, just a blank page. is there anyway to set up a page such as "You IP Address has been banned,
View 4 Replies View RelatedI formatted my server and installed CENTOS 7 and PLESK 12. I have problems with cbl.abuseat.org. My ip enters in blacklist. I sent email to the support of abuseat.org and abuseat reply:
Please fix your HELO strings.
I check the my configuration and I think is correct:
- Reverse lookup is ok
- Hostname is ok (server.domain.tld)
But I have the file in /etc/sysconfig/network empty. There is only written: # Created by anaconda
Also, is correct the my etc/hosts file?
127.0.0.1 server.domain.tld server localhost4 localhost4.localdomain4
:: 1 server.domain.tld server localhost6 localhost6.localdomain6
Is there a reason to set a high TTL for DNS? Like the standard is a few days.I set mine to 10 minutes. So whenever I do a change its propagated within 10 minutes. Is there a reason this would be bad? I realize it means more queries to my server, but 10 minutes is still rather long, not like thats going to totally hammer my server,
View 7 Replies View RelatedWe currently have a server that has Windows 2003 and were wondering the advantages of upgrading to R2? How I spend the extra money for an upgrade? Please no linux comments
View 11 Replies View Relatedtoday 3ix.com logged into my ftp account and delete some files! i thought the site is hacked but the truth my site didn't hacked ! when i asked the support team to allow me to change my ftp details from the client area he said to me " Help24x7: Well, we got complaint from SpamCop against your site and we are unable to host it "
this problem was solved long time ago and spamcup register here in the forum and said to all " im sorry the report was false" ! then 3ix.com restord my account again , why they now open this old problem!
look here at the problem you will finde the full details
[url]
and here the hostcare admin said to me we are sorry the report was false ! we are going to restore your account " We just got confirmation from SpamCop that they feel the complaint was false and I have asked a 3iX Admin to restore your site, it will be live in the next 60 minutes.
Thank you for working with us to resolve the issue, don't hesitate to contact the 3iX HelpDesk if you have any further difficulties.
Regards "
[url]
im very wondering ! why they open this olde proble again! they wast my time and mak me very sad.
dose this justice?
here is also another person they treminate his account please read
[url]
my server was down today and i want to know the reason can you please help me by pointing out the log files i should check?
Am runing CentOS 4.x with many domains on the server,
I have a dual processor, dual core server with 12GB memory.. It uses less than 4% CPU utilization and less than 5% memory utilization, but for some reason It's really slow to load sites...
I know this isn't much information, but would any have any ideas as to what could cause the slow speed?
If is anyone is available to look at it, I'll pay you (obviously).
I'm having my first DDOS attack. Do people DDos servers for no reason? Beacause they are attacking an IP on a server that have not had any sites or any use on it for 4 years.
View 4 Replies View RelatedI can not find anything weird on the server.
Everything seems normal.
Why the traffic go high suddenly, then it drop to normal after a while.
well i made a PhpBB2 forum and im hosting it on my PC using wamp and no-ip but when my friend trys to access it he gets this.
You don't have permission to access / on this server.
I have port forwarded port 80 and everything else i could think of.
i have a Centos server that install Xen and hypervm in it.
i have some vps in this server.
i restart server and after that i get this eror for run vps :
Could Not Start Vps, Reason: Error: Device 0 (vif) could not be connected. Could not find bridge, and none was specified:
how can i solved this problem ?
my server is : Centos5.2
Like if you try to make your own server, it would cost a few thousand right? Or bought one from IBM or something. If you rent a server, it could cost you like double that I notice or even more in a period of a year.
I was looking at the prices of Xeon 5420 and they are like only 400 or something. Motherboard, ram, hdd's shouldn't amount to too much right?
And companies are charging like 50 bucks a month for a 2 gigs of ram.
Or am I actually looking at this wrong and actually am looking at desktop components? So is bandwidth the cost for these prices? In the long run aren't people being ripped off?
I have a shared server (root access) using Cpanel / Centos with suphp enabled.
Twice this week the sever's load skyrocketed and was unable to login to trace teh cause, had to reboot instead.
After reboot, I went to whm > CPU/Memory/MySQL Usage and saw nothing in red aside netstat (21% cpu). I'm not sure if this is the cause, but how can I trace the absolute user or script causing this spike?
I have a dedicated machine collocated at some hosting provider and after a while (14 days or so, but timeframe is not constant) it hangs for no apparent reason. It happened 2 times already. Nothing in the logs (it logs everything), nothing at all.
Before the commission the machine was running for a month without any problems.
The first time it happened the tech guy plugged in monitor and keyboard and could not see anything on the display. Before that machine was not loaded with any traffic, nobody should have actually known it is there (except for some DNS traffic). It took some 20 days of uptime.
The second time it happened was yesterday, after some 15 days of uptime.
I suspect hardware malfunction because I have 2 "identical" (OS & progs, not the hardware) systems running without any problems. It is an HP DL380 G5 machine, the problematic one.
I got a new hard drive. After just completing the wonderful instructions on how to rename video files on the server, the new hard drive has just "misplaced" over 1200 of my exclusive videos!
I didnt erase anything, but now the hard drive can only see upto a certain letter, all after that has gone.........is there any way this hard drive can restore these files? its getting ridiculous now
PRODUCT, Plesk for Windows VERSION 11.5 latest update VERSION OF MICROUPDATE 11.5.30 Actualizar #39, OPERATING SYSTEM Windows 2008 Server Suddently with no apparent reason, MYSQL stops and Ihave to go to the panel and restart it.
Every Morning I have to restart MySQL thru the control panel in remote console of windows..Works all day long, and then stops at night..Should work as always did, for several months I did not even reboot the server, no I have to reboot the server to see if that fixes the problem. Latest windows update, latest Plesk for windows update, but I have the feeling that with the latest microupdate something has broken,
httpd failed @ Thu Jul 30 15:55:02 2009. A restart was attempted automagically.
Service Check Method: [tcp connect]
Failure Reason: Timeout while trying to connect to service
and
httpd failed @ Thu Jul 30 15:29:57 2009. A restart was attempted automagically.
Service Check Method: [tcp connect]
Failure Reason: Unable to connect to port 80
we use CentOS Linux 7.0.1406 (Core) Plesk Version 12.0.18 Update #26 I got reports of several users on my system, and i can confirm this myself, that fail2ban is blocking courier imap and postfix connections when i try to connect to the Plesk Server with Outlook 2013 and theBat and the Apple Mac Mail Client.
I used the correct login information but fail2ban blocked the IPs for no obvious reason:
Code:
2014-12-03 12:46:57,908 fail2ban.actions[920]: WARNING [plesk-postfix] Ban 82.134.94.102
2014-12-03 12:46:58,049 fail2ban.actions[920]: WARNING [plesk-courierimap] Ban 82.134.94.102
I disabled the two jails now and it works perfectly. But why is fail2ban blocking valid requests ? I tried it myself and i did not enter a wrong password or something. MaxRetry is 5 so this should not be a problem. The problem is not affecting all users but just a few. However all of them are using correct credentials so i dont understand why they are being blocked at all.
I have tried everything I know (I know not much)
I have rebooted it multiple times. I have terminated lots of account and now I have only 2 or three accounts.
I have removed all the fishy scripts. Done everything I can.
But it just becomes un responsive within a minute of re booting.
Its a Pentium 4 Single Core server.
1GB Ram and 160GB harddisk with cpane+WHM.
I get error
cpsrvd failed @ Thu Dec 11 19:50:43 2008. A restart was attempted automagically.
Failure Reason: Unable to connect to port 2086
I cannot even connect to server because within minutes the server hangs.