We are using Support Trio as ticketing system.. Everything works fine but Unable to attach file with ticket.
Before it was working fine but recently we have moved our server then issue started.
Trio support department saying that check your php as this issue not at their end
Using PHP 4 and mysql 4 version.
For the last 6 months our site has been under severe brute force, syn flood attack. They keep bombarding a single URL of the server and it is xml file. They are not attacking any other URL.
We have removed the xml page from our site but still they keep on sending requests, this is for the last 6 months non stop.
The IP has been changed just to see and they are sending several thousand requests per second. The requests come from different IPS and different ranges, so you can not even block the IP’s. They seem to be coming from a legitimate IP’s.
Due to this I have had to pay for an extremely expensive server which holds 8 GB of RAM and quad core processor etc, however, even with this the server server still reaches critical level, just because these requests are eating up my resources.
Our technical team has been working on all aspects of apache server security, external modules, firewall, hardware firewall from beginning but still we are not able to stop them.
We have installed following modules.
4) mod_security
5) mod_evasive
6) Firewall
7) SYS_Cookies enabled
We have worked with the hosting company and their technical team leader, he installed the best CISCO hardware firewall and tried to stop them, but in vain.
We have checked our server to see if anything from our site is causing the request, no extra file uploaded on to the server. For example if some file has been upload or some text has been added to the file (checked if we’ve been hacked). Even though we checked for any hacks, I am still wondering if there is something we do not know about. Can a hack lead to huge amounts of traffic?
We need some help to stop these attacks. We have searched a lot and have found that sites that get attacked like this have only one option is to shut down till it stops. I really hope that will not be the case for us. Please let us know if any one has any ideas to deal with this.
Also could it be our own part of php code which can do this? We are ready to check every php file to make sure it does not have any line of code which can be dangerous?
We worked with hardware firewall company to drop a request on the spot coming for the single URL but it is getting setup.
We have antivirus running on server however if any specific antivirus or antimalware is needed, we can try that.
Following are the details I have got from my linux admin. This will help you to trace the issue in better way.
Problem: Apache SYN_RECV
OS - RHEL5
kernels - 2.6.18-92.1.22.el5-x86_64
2.6.18-92.el5-x86_64
rpms:-
kernel-devel-2.6.18-92.el5
kernel-headers-2.6.18-92.1.22.el5
kernel-devel-2.6.18-92.1.22.el5
kernel-2.6.18-92.1.22.el5
kernel-2.6.18-92.el5
OS Type:
cat /etc/issue
Red Hat Enterprise Linux Server release 5.2 (Tikanga)
> cat /proc/version
Linux version 2.6.18-92.1.22.el5 (mockbuild@hs20-bc2-5.build.redhat.com) (gcc version 4.1.2 20071124 (Red Hat 4.1.2-42)) #1 SMP Fri Dec 5 09:28:22 EST 2008
We are providing 403 code for the URL request.
netstat:
tcp 0 0 domain.com:http 85-156-91-20.elisa-mo:55168 SYN_RECV
tcp 0 0 domain.com:http 220.255.7.227:27183 SYN_RECV
tcp 0 0 domain.com:http 5e03cbc4.bb.sky.com:51086 SYN_RECV
tcp 0 0 domain.com:http 79.126.234.198:18139 SYN_RECV
tcp 0 0 domain.com:http 78.148.175.148:11115 SYN_RECV
tcp 0 0 domain.com:http 83-154-143-68.rev.lib:61479 SYN_RECV
tcp 0 0 domain.com:http ABTS-North-Static-248:54775 SYN_RECV
tcp 0 0 domain.com:http 90-230-131-95-no130.tb:1134 SYN_RECV
tcp 0 0 domain.com:http static-host119-73-6-2:49538 SYN_RECV
tcp 0 0 domain.com:http 222.127.130.238:gtp-control SYN_RECV
tcp 0 0 domain.com:http acl1-1571bts.gw.smartbr:g5m SYN_RECV
tcp 0 0 domain.com:http athedsl-282427.home.o:60002 SYN_RECV
tcp 0 0 domain.com:http CPE-58-166-77-138.nsw:60067 SYN_RECV
tcp 0 0 domain.com:http C-59-101-99-107.syd.c:51097 SYN_RECV
tcp 0 0 domain.com:http ti0111a380-2667.bb.on:60993 SYN_RECV
tcp 0 0 domain.com:http 92.81.2.242:60451 SYN_RECV
tcp 0 0 domain.com:http 118.100.120.248:pserver SYN_RECV
tcp 0 0 domain.com:http triband-del-59.178.84:50140 SYN_RECV
tcp 0 0 domain.com:http cpc4-leds5-0-0-cust82brpd SYN_RECV
tcp 0 0 domain.com:http ALyon-153-1-8-78.w86-:59494 SYN_RECV
tcp 0 0 domain.com:http 120.28.199.183:3comnetman SYN_RECV
tcp 0 0 domain.com:http h248.4.16.98.dynamic.:60758 SYN_RECV
tcp 0 0 domain.com:http 89.211.205.59:64217 SYN_RECV
tcp 0 0 domain.com:http CPE-124-187-26-30.qld:ff-sm SYN_RECV
tcp 0 0 domain.com:http frw.Gloworld.com:59104 SYN_RECV
tcp 0 0 domain.com:http 220.255.7.182:winpoplanmess SYN_RECV
tcp 0 0 domain.com:http srisaionline180.excell:1232 SYN_RECV
tcp 0 0 domain.com:http CPE-60-230-16-150.vic:52611 SYN_RECV
tcp 0 0 domain.com:http 203.82.91.102:41318 SYN_RECV
tcp 0 0 domain.com:http 69.171.165.50:32454 SYN_RECV
tcp 0 0 domain.com:http dsl-TN-static-195.:corbaloc SYN_RECV
tcp 0 0 domain.com:http 210.186.66.179:49330 SYN_RECV
tcp 0 0 domain.com:http ABTS-North-D:xinuexpansion3 SYN_RECV
tcp 0 0 domain.com:http c122-106-133-46.livrp:49273 SYN_RECV
tcp 0 0 domain.com:http 173.subnet125-1:nssalertmgr SYN_RECV
tcp 0 0 domain.com:http 121.246.52.30.dynamic:63977 SYN_RECV
tcp 0 0 domain.com:http mobile-3G-dyn-BC-179-1:4464 SYN_RECV
tcp 0 0 domain.com:http crd48.neoplus.adsl.t:aminet SYN_RECV
Following we have done till now is mentioned below for the configurations.
###############
sysctl.conf
##############
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.
# Controls IP packet forwarding
net.ipv4.ip_forward = 0
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
# Controls whether core dumps will append the PID to the core filename
# Useful for debugging multi-threaded applications
kernel.core_uses_pid = 1
# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1
# Controls the maximum size of a message, in bytes
kernel.msgmnb = 65536
# Controls the default maxmimum size of a mesage queue
kernel.msgmax = 65536
# Controls the maximum shared segment size, in bytes
kernel.shmmax = 68719476736
# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 4294967296
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
# Enable IP spoofing protection, turn on Source Address Verification
net.ipv4.conf.all.rp_filter = 1
# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1
# 65536 seems to be the max it will take
net.ipv4.ip_conntrack_max = 1048576
net.ipv4.tcp_rmem = 4096 87380 8388608
net.ipv4.tcp_wmem = 4096 87380 8388608
net.core.rmem_max = 8388608
net.core.wmem_max = 8388608
net.core.netdev_max_backlog = 5000
net.ipv4.tcp_window_scaling = 1
#############
fwsnort, bfd burnintest chkrootkit ddos faf lsm nobody_check sim apf
#############
modsecurity-apache
LoadModule evasive20_module /usr/lib64/httpd/modules/mod_evasive20.so
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 3
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 30
</IfModule>
LoadModule security_module /usr/lib64/httpd/modules/mod_security.so
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 3
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 30
</IfModule>
####################
When we try to browse domain.com get below error.
==============================================
CWebsite.GetWebServerName error '80040403'
Unable to get web server name. Please try again or contact support.
/interfaces/standard/SiteProperties.asp, line 139
==============================================
MY VPS IS DOWN.
i have this error on concole on hypervm
enter into CT 1820 failed
Unable to open pty: No such file or directory
I have following error when try to login in my vps, how can resolve this issue?
Code:
Last login: Thu Jun 19 21:00:43 2008 from xxx.xxx.xxx.xxx
ALERT! You are entering a secured area! Your IP and login information
have been recorded. System administration has been notified.
This system is restricted to authorized access only. All activities on
this system are recorded and logged. Unauthorized access will be fully
investigated and reported to the appropriate law enforcement agencies.
enter into VE 270 failed
Unable to open pty: No such file or directory.
I am not able to change the attribute of a file using the command chattr. Please see the output below.
root@server [~]# lsattr /etc/exim.conf
----ia------- /etc/exim.conf
root@server [~]# chattr -ai /etc/exim.conf
root@server [~]# lsattr /etc/exim.conf
----ia------- /etc/exim.conf
In fact, I can change the attributes for all the other files.
I noticed that attribute of /etc is I
root@server [~]# lsattr -d /etc
----------I-- /etc
Apache error log for a subdomain
[Thu Apr 17 00:02:24 2008] [crit] [client 69.113.17.156] (13)Permission denied: /home/user/public_html/subdir/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable
However, there is no htaccess file in that directory anyway
/home/user/public_html/subdir
Server is Centos 5 / Cpanel
On Plesk 11.5.30 I have just patched with SSLfix.sh. [URL] ......
When I run an ssl check I get - Certificate name mismatch
I am also getting the following message
Unable to generate the web server configuration file on the host because of the following errors:
Template_Exception: apache2: Syntax error on line 211 of /etc/apache2/apache2.conf: Syntax error on line 73 of /etc/apache2/mods-enabled/ssl.conf: </IfModule>SSLHonorCipherOrder without matching <IfModule>SSLHonorCipherOrder section
[Code] .....
I have installed Plesk 11.x windows version. I use that for 1 month but now I want to login to panel by http://mysite.com:8880 get error:
The system cannot find the file specified. (Error code 2) at Unable to connect to pipe .pipeP_85da9518-b79d-49a6-a154-e5055dc53d7c
I get this error after upgrade from Parallels Plesk 11.5 for Linux to 12.0.18 (Ubuntu 12.04.4 LTS):
Template_Exception: nginx: [emerg] PEM_read_bio_X509_AUX("/opt/psa/var/certificates/certI3Fakms") failed (SSL: error:0906D064EM routinesEM_read_bio:bad base64 decode) nginx: configuration file /etc/nginx/nginx.conf test failed
file: /opt/psa/admin/plib/Template/Writer/Webserver/Abstract.php line: 75 code: 0
Reconfigure all does not work:
web:Execution failed. Command: httpdmng Arguments: Array ( [0] => --reconfigure-all )
Details: Execution failed. Command: httpdmng Arguments: Array ( [0] => --reconfigure-server [1] => -no-restart )
Details: [2014-06-22 02:23:16] ERR [util_exec] proc_close() failed [2014-06-22 02:23:21] ERR [util_exec] proc_close() failed
[Code] .....
On attempting to select the configuration->filter option on RoundCube, we got the error message:
SERVICE CURRENTLY NOT AVAILABLE!
Error No. [501]
On /var/log/plesk-roundcube/errors we can see the following logs:
[06-Jun-2015 14:57:17 -0300]: PHP Error: SieveRules plugin: Unable to open default rule file in /usr/share/psa-roundcube/plugins/sieverules/sieverules.php on line 1523 (GET /roundcube/?_task=settings&_action=plugin.sieverules)
...
[06-Jun-2015 14:57:17 -0300]: PHP Error: SieveRules plugin: Unable to open example rule file in /usr/share/psa-roundcube/plugins/sieverules/sieverules.php on line 1560 (GET /roundcube/?_task=settings&_action=plugin.sieverules)
...
[06-Jun-2015 14:57:17 -0300]: PHP Error: Error loading template for sieverules.sieverules in /usr/share/psa-roundcube/program/include/rcmail_output_html.php on line 496 (GET /roundcube/?_task=settings&_action=plugin.sieverules)
I can not log into to plesk right now. It's display message " Unable to read Control Panel configuration file: date_default_timezone_get() [function.date-default-timezone-get]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_ timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier.We selected 'Asia/Krasnoyarsk' for '7.0/no DST' instead".
View 1 Replies View RelatedWhen i add the private key and certificate via plesk panel, i get the following error:
ERR [panel] Unable to set the certificate: Unable to put certificate file: Unable to arrange cert file: file_put_contents failed:
version: Parallels Plesk Panel v11.5.30_build115130819.13
os: centos 6.5 (final)
I recently received this messsage from in my mailbox "Unable to generate the web server configuration file on the host <nsxxxxxxx.ovh.net>" which is coming now every hour for 4 days now.
I first tried to regenerate an apache conf file with the magic on my Centos 6:
# /usr/local/psa/admin/sbin/httpdmng --reconfigure-all
but it gives me this output:
Execution failed.
Command: httpdmng
Arguments: Array
(
[0] => --reconfigure-server
[1] => -no-restart
[Code] .....
At line 10 in my server.conf file I have a bunch of ipv6 address that looks like this:
NameVirtualHost xx.xx.x.xx:80
NameVirtualHost [xxxx:xxxx:8:5b11::1000]:80
NameVirtualHost [xxxx:xxxx:8:5b11::1001]:80
NameVirtualHost [xxxx:xxxx:8:5b11::1002]:80
[Code] ....
After the last update, I get this error:
Unable to generate the web server configuration file on the host <xxx.de> because of the following errors:
Template_Exception: nginx: [emerg] PEM_read_bio_X509_AUX("/usr/local/psa/var/certificates/certRHXRsQy") failed (SSL: error:0906D064EM routinesEM_read_bio:bad base64 decode)
nginx: configuration file /etc/nginx/nginx.conf test failed
file: /usr/local/psa/admin/plib/Template/Writer/Webserver/Abstract.php
line: 75
code: 0
Please resolve the errors in web server configuration templates and generate the file again.
the websites of my customer are not reachable now....
After enabling File Sharing in Plesk 12, the service appears to function correctly. If only a few files are uploaded, they are ok. However, after uploading a directory structure with a handful of MB, and subdirectories, File Sharing stops. It shows at the top of the screen:
"Internal error: The File Sharing service is temporarily unavailable because the site is down for maintenance."
it also says in the main window:
"Unable to load folders list."
Clicking on Upload Files, that dialog also shows "Unable to load folders list."
I have checked that the ownership of those files on the server is www-data:www-data , and that permissions are 755 for directories and 644 for files, because it seems like ownership and permissions could be an issue, however that doesn't fix it. Removing all the files in the share does fix it, however that's not useful if the files should be available for sharing.
I'm unable to access my plesk control panel .its giving this error "Unable to read Control Panel configuration file";tried all available solution for permissions but the problem remains.
View 3 Replies View RelatedI just installed the Health Monitor add-on in a brand new Plesk 11.5.30 on CentOS 6.4 but all that it's area in Plesk displays is this funky looking error:
{"status":"error","statusMessages":[{"status":"error","class":"","content":"Unable to load configuration file.Click to expand...
I have a one problem in my server . I use in Parallels Plesk v12.0.18_build1200140606.15 os_CentOS 6 I vps in systemOS CentOS6.6 Final Minimal and installing plesk health monitor show error in :
{"status":"error","statusMessages":[{"status":"error","class":"","content":"Unable to load configuration file.
And I try the command
/usr/local/psa/bin/sw-engine-pleskrun /usr/local/psa/admin/plib/scripts/setup-health-monitor.php
output problem is :
Error: Unable to read /proc/partitions
I have some error with my server. All my sites are inaccessible.
Code:
Template_Exception: nginx: [emerg] SSL_CTX_use_PrivateKey_file("/opt/psa/var/certificates/cert-ao0glw") failed (SSL: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:Type=X509_ALGOR error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:Field=pkeyalg, Type=PKCS8_PRIV_KEY_INFO error:0907B00D:PEM
[Code] .....
We have Panel Plesk 11.5.30 in Windows 2008 R2. when you go to File Sharing in all the Subscriptions, appears this error: Internal error: Unable to access File Sharing repository with the system user name "admin": wrong username or password
This happen since we do the update to the new version 11.5.30 ...
I have problem:
Searching /root....
Found cpmove-clanpz.tar.gz!
Moving Packge to /root/cprestore/cpmove-clanpz.tar.gz
Extracting tarball....window.scroll(0,175);...............
Done
Extracting Domain....Done
Sorry, the copy failed. Unable to find the cpanel user file. Is the archive missing (cwd: /root/cprestore loaded cpmove-clanpz/cp/clanpz)?
checked 4 files.....
1. /scripts/pkgacct username...
2. Transfer backup to new server
3. /scripts/restorepkg username
4. this error
I'm build Plesk Panel for Linux and Presence Builder, I don't want my user can upload their website to hosting via File Manager. How can I do it...
View 2 Replies View RelatedHas anybody heard of Flash Support and Real AudioVideo Support? MMHosting.com offers this kind of support and I wonder if it's effective?
What do you think of it?
Say I have 2 websites and they all use file.php which is located on mainserver.com/file.php.
I want to use the file like this:
website1.com/file.php
website2.com/file.php
I'm undecided between an upcoming dedicated hosting server and am moving between Softlayer and ThePlanet. My decision partly comes down to support.
I've read many reviews on WHT about both companies, but not necessarily comparing them from people who have experienced both.
So my questions (keep in mind this is my first dedicated. I have used VPS in the past with good support) Which offers MORE support (not better) - I'm curious which company might consider my support questions as "part of the default service package" or "need additional service plan for that" More detailed support - my usual experience with support is support staff assume you already know a high level so it may take going forward and back 5 times via email to get a full answer
Overall support satisfaction - any other comments
I've been with Hivelocity for 2 years. Occasionally we have problems, but it works. Their support staff can do very simple things relatively fast, however if you have some serious problems, e.g. failed disk and need to be replaced and do restoration from backup, it will be hell!
They will NOT do what asked in Reload Request, delayed answer to chat, no answer to tickets for many hours.
So far I'm very disappointed of Hivelocity support.
Rapidly growing error logs showing the same message
$ug-non-zts-20020429/ffmpeg.so' - /usr/local/lib/php/extensions/no-debug-non-zts-20020429//usr/local/lib/php/extensions/no-debug-non-zts-20020429/ffmpeg.so: cannot open shared object file: No such file or directory in Unknown on line 0
root@server [~]# ls /usr/local/lib/php/extensions/no-debug-non-zts-20020429
./ ../ eaccelerator.so*
root@server [~]# ls /usr/local/lib/php/extensions/no-debug-non-zts-20020429
./ ../ eaccelerator.so*
Using cpanel 11 / centos 4
i have a server with centos,
i need to edit the hidden file .htaccess from the file management tool of cpanel,
but the hidden files not shown,
ow can i modify the setting and let the files shown in the file management tool of cpanel?
How can we stop Plesk resetting the file permissions on a dll file that is found in
C:Program Files (x86)
??
Specifically,
we have a file, jmail.dll,
here
C:Program Files (x86)Dimacw3JMail
By default Plesk permissions are set to DENY for PSACLN.
But the JMail plugin cannot work with these permissions !
We change this to be ALLOW for READ & EXECUTE and DENY for WRITE.
And everything works fine.
But every time Plesk does an update it reverts it back !
This means that a number of our customers contact forms stop working !