I found an IP that send a lot of request to my httpd. At least 20 requests/second. I think the guy behind that IP want to auto download some of my files from my server.
I already used .htaccess to block the ip. It works. But becasue there are too many request from this guy, it make the server a bit slow. Is there any method I can totally block this ip from a server level? Am I need to use a firewall?
[Wed May 14 18:15:17 2008] [error] [client 66.228.119.67]
Invalid URI in request entersomenicedatastringshereidontthinkthisislongenoughsoiwilladdmoreheherr669760763646r
My Dedicated server is being slow - hopefully someone can give a helping hand
Processor: AMD Single CPU Dual Core Athlon 4200
Memory: 2048MB RAM
Primary Hard Drive: 160GB
Operating System : CentOS 4.x X86_64 Bit
Control Panel: CPanel
uplink port: 100
Apache version 1.3.37
php 4.4.4
I have a client who's Apache on a CPanel based VPS keep's restarting.
In the error log we recieve two of these lines
"client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFin "
Then the Apache will restart.
I have looked around and found some threads about this problem, but none explaining how to fix this.
i am using seperate server for sql .But my httpd server failed many time when i checked maximum number of httpd connection then my sql server using too many connection what is the reason of this problem . Is my sql server using as a slave in a ddos attack or sql server need http connection?
View 2 Replies View RelatedI trying:
Code:
[root@serwer /]# httpd restart
/usr/sbin/httpd restart: httpd not running, trying to start
/usr/sbin/httpd restart: httpd could not be started
Code:
[root@serwer /]# /etc/rc.d/init.d/httpd configtest
Syntax OK
Help
I'm curious. I have read some stuff recently about Amazon, Mosso and other clouds. I know Mosso has switched over to a request based pricing model and I realized that I am not sure exactly what a 'request' is.
I think that a hit, as tallied by AWStats, Webalizer, etc. would be the same thing as a request, but I wasn't 100% sure if that was the case with Mosso. I actually contacted Mosso support (someone I know is considering using them) to ask them for clarification on a request. They stated that a page with two images would be three requests, one for each image and one for the page itself. I asked if it was the same as 'hits' and they said no, it isn't. This didn't sound right to me, because my understanding of 'hits' is the same as how he described 'requests'.
So, I figured I would just ask the experts on WHT.
I have a script that needs to make a port 80 request to itself and it seems that there is something blocking that request. where should i look to correct this problem?
View 14 Replies View RelatedI couldnt find my past forum post regarding a good service from LA to Australia.
Mainly, Im looking for a LA service which will provide me with super times to melbourne australia. I need a company which is small and that can provide me with fast support and great speeds.
I dont really want a big company.
Can I have some of you ping 24fans.net and let me know what your results are? Also where you're located would be good.
My ISP is being crappy and my dsl line is basically down ever few minutes. They're supposed to fix it tomorrow.
My current results are:
Reply from 70.84.145.91: bytes=32 time=66ms TTL=51
Reply from 70.84.145.91: bytes=32 time=59ms TTL=51
Reply from 70.84.145.91: bytes=32 time=65ms TTL=51
Reply from 70.84.145.91: bytes=32 time=58ms TTL=51
This doesn't really have anything to do with my dsl being crappy, but rather I'm just curious as to what kind of responses people are getting around the world.
Can some nice person please write a good tutorial on setting up the game server cpanel addon?
View 1 Replies View RelatedWhere could I find the following or how much would a custom plan with the following details cost:
Fair share of a decent cpu(s)
256mb RAM guaranteed
5-6gb space
100-250gb bandwidth
That allows:
IRC usage
Low-resource game server (9-13mb RAM, 2-5% cpu usage).
Can you see if my site will load for you:
[url]
Then (if it loads) post the stats from the bottom of the page:
Page creation time: (Numbers)
And:
Your Os:
Your Browser:
Some people say my site won't load or is loading slowly for them, but I have no one to test it, thanks. If possible, I need quite a few tests.
Request response time on my openvz node is very very low!
Load is below than 4 6 5
But ping, http, mysql, ... response time is very low!
Id like to have a feedback from user who have experience from them.
Are good , response? I want a server and seems to be a good choice
I'm seeing this event a lot in the IPS logs of my Baraccuda load balancer (no granularity, pretty much just 'on' or 'off').
View 0 Replies View RelatedIn my logs:
[Tue Jul 22 01:01:35 2008] [error] [client x.x.x.x] Invalid URI in request GET . HTTP/1.0
(yes, that is it for this entry/line)
This showed up in logwatch as:
Requests with error response codes
400 Bad Request
.: 4 Time(s)
...what was this guy trying to do?
The offending IP was banned in APF last night, if his IP is still showing up in my logs, is he using aproxy?
After adding his ip to:
/etc/apf/deny_hosts.rules
I ran:
apf -r
Has anyone here tried BlowOutHosts? They seem to have very good offer now
DUAL XEON QUAD CORE 5405 /1066FSB / 12MB CACHE
16GB DDR2 FB-DIMM
x2 300GB 15,000RPM SAS (RAID-1)
5 IPs (4 usable)
Free KVMoIP! (DRAC Card)
3,500 GB Bandwidth
1000 Mbps Port
$300.00/Month
This setup could run at least 600$/month anywhere else.
But, they are very new company so i would like to hear some reviews, opinion.
After signing up with zone, setup was delayed but support staff added 5 Gigs of storage to compensate. Thank you for that.
After almost 4 weeks of back and forth with support (we have the managed package), we are still not able to get emails delivered to Hotmail's Inbox. Sean & team have tried a few tweaks but email is still not getting through but end up in the junk folder.
At this point, the VPS is of no use to us since we cannot get emails delivered to Hotmail's Inbox (and many members have registered for newsletters using a Hotmail account).
I understand that Zone is to supply a fully managed VPS and they have. Everything works except getting emails through to Hotmail. We have left voicemails and support tickets to Sean (and billing) asking to see if they can make an exception for our special case and do a pro-rated refund for us (there are 5 months left and the first month was all trying to get the Hotmail issue resolved). But voicemails and support tickets have gone unanswered for a few days. Anyone else seeing this delay in reply from the Zone?
when i check apache status, i see one domain send many request to server, for example:
domain.com 10.20.30.40
domain.com 10.20.30.40
domain.com 10.20.30.40
domain.com 10.20.30.40
domain.com 10.20.30.40
-
-
-
how can i prevent this problem?
this problem tease me and my server, because induce apache to work unremitting.
Ram Usage is: 65%!
Is there a way to construct an HTML request so that only HTML text is returned (without images or rich media)? I assume search engines do this - how?
What I'm trying to do is write an Apache module that will retrieve only text from a web site. The idea is to provide a Lynx-like experience, using Apache as a proxy between my workstation and my ISP.
Has anyone experienced with ssahost.com?
View 4 Replies View RelatedI have an somewhat unusual requirement. I need a hosted Vista or XP desktop somewhere.
This is not to host a server application. The reason I need it is that I need to give my staff access to an application that only runs on an XP or vista desktop environment, and I dont want the software in question installed on their pc, instead they will log on via remote desktop and use it that way. The application does *not* run on Win Server 2003.
I have looked high and low, but all the Windows VPS services on the market seem to be hosting Win Server 2003 exclusively, which is no use to me. Does anyone out there know if it is possible to get hosted XP or Vista anywhere?
I am aware that there are a couple of providers who will host a vmware vm for you but even they seem to be oriented towards Win Server, which is no use to me.
I am working with XAMPP 5.6.8 (Apache 2.4.4, MySQL 5.5.32 and PHP 5.6.8 ) on a 64 bits Windows 7 Ultimate (Service Pack 1) Operating System.
I am working with an Arduino UNO and a WIFI Shield connected to the Apache server.
I am sure Arduino is connected to the WiFi network and to the server, and it also sends the GET request to the server.
Apparently, everything is OK because I can see the 200 OK message from the server in the Arduino serial monitor, but I find no trace of that request in the server log although all the requests made from the browser (by typewriting the server address in the browser address bar and pressing enter) appear in the server log.
I'm starting a small, local company in Illinois that will create web pages and host them for residents around my community such as lawyers, doctors, etc. I don't believe I should go with shared hosting because that would not be fair to my clients and I would like to give them good, reliable service so their business does well too. Which entry level, or basic dedicated server should I rent for this purpose? Since I'm just starting, I wouldn't want to overspend, but at the same time I do want performance for the few initial clients I receive. As my company grows, I'm sure I'll migrate into a more large scaled server(s). Any quotes or companies anyone can refer or think of? And possible quote for this type of server/situation.
View 3 Replies View RelatedIt seems every few VPS's this happens.
Quote:
PTY allocation request failed on channel 0
For the last 6 months our site has been under severe brute force, syn flood attack. They keep bombarding a single URL of the server and it is xml file. They are not attacking any other URL.
We have removed the xml page from our site but still they keep on sending requests, this is for the last 6 months non stop.
The IP has been changed just to see and they are sending several thousand requests per second. The requests come from different IPS and different ranges, so you can not even block the IP’s. They seem to be coming from a legitimate IP’s.
Due to this I have had to pay for an extremely expensive server which holds 8 GB of RAM and quad core processor etc, however, even with this the server server still reaches critical level, just because these requests are eating up my resources.
Our technical team has been working on all aspects of apache server security, external modules, firewall, hardware firewall from beginning but still we are not able to stop them.
We have installed following modules.
4) mod_security
5) mod_evasive
6) Firewall
7) SYS_Cookies enabled
We have worked with the hosting company and their technical team leader, he installed the best CISCO hardware firewall and tried to stop them, but in vain.
We have checked our server to see if anything from our site is causing the request, no extra file uploaded on to the server. For example if some file has been upload or some text has been added to the file (checked if we’ve been hacked). Even though we checked for any hacks, I am still wondering if there is something we do not know about. Can a hack lead to huge amounts of traffic?
We need some help to stop these attacks. We have searched a lot and have found that sites that get attacked like this have only one option is to shut down till it stops. I really hope that will not be the case for us. Please let us know if any one has any ideas to deal with this.
Also could it be our own part of php code which can do this? We are ready to check every php file to make sure it does not have any line of code which can be dangerous?
We worked with hardware firewall company to drop a request on the spot coming for the single URL but it is getting setup.
We have antivirus running on server however if any specific antivirus or antimalware is needed, we can try that.
Following are the details I have got from my linux admin. This will help you to trace the issue in better way.
Problem: Apache SYN_RECV
OS - RHEL5
kernels - 2.6.18-92.1.22.el5-x86_64
2.6.18-92.el5-x86_64
rpms:-
kernel-devel-2.6.18-92.el5
kernel-headers-2.6.18-92.1.22.el5
kernel-devel-2.6.18-92.1.22.el5
kernel-2.6.18-92.1.22.el5
kernel-2.6.18-92.el5
OS Type:
cat /etc/issue
Red Hat Enterprise Linux Server release 5.2 (Tikanga)
> cat /proc/version
Linux version 2.6.18-92.1.22.el5 (mockbuild@hs20-bc2-5.build.redhat.com) (gcc version 4.1.2 20071124 (Red Hat 4.1.2-42)) #1 SMP Fri Dec 5 09:28:22 EST 2008
We are providing 403 code for the URL request.
netstat:
tcp 0 0 domain.com:http 85-156-91-20.elisa-mo:55168 SYN_RECV
tcp 0 0 domain.com:http 220.255.7.227:27183 SYN_RECV
tcp 0 0 domain.com:http 5e03cbc4.bb.sky.com:51086 SYN_RECV
tcp 0 0 domain.com:http 79.126.234.198:18139 SYN_RECV
tcp 0 0 domain.com:http 78.148.175.148:11115 SYN_RECV
tcp 0 0 domain.com:http 83-154-143-68.rev.lib:61479 SYN_RECV
tcp 0 0 domain.com:http ABTS-North-Static-248:54775 SYN_RECV
tcp 0 0 domain.com:http 90-230-131-95-no130.tb:1134 SYN_RECV
tcp 0 0 domain.com:http static-host119-73-6-2:49538 SYN_RECV
tcp 0 0 domain.com:http 222.127.130.238:gtp-control SYN_RECV
tcp 0 0 domain.com:http acl1-1571bts.gw.smartbr:g5m SYN_RECV
tcp 0 0 domain.com:http athedsl-282427.home.o:60002 SYN_RECV
tcp 0 0 domain.com:http CPE-58-166-77-138.nsw:60067 SYN_RECV
tcp 0 0 domain.com:http C-59-101-99-107.syd.c:51097 SYN_RECV
tcp 0 0 domain.com:http ti0111a380-2667.bb.on:60993 SYN_RECV
tcp 0 0 domain.com:http 92.81.2.242:60451 SYN_RECV
tcp 0 0 domain.com:http 118.100.120.248:pserver SYN_RECV
tcp 0 0 domain.com:http triband-del-59.178.84:50140 SYN_RECV
tcp 0 0 domain.com:http cpc4-leds5-0-0-cust82brpd SYN_RECV
tcp 0 0 domain.com:http ALyon-153-1-8-78.w86-:59494 SYN_RECV
tcp 0 0 domain.com:http 120.28.199.183:3comnetman SYN_RECV
tcp 0 0 domain.com:http h248.4.16.98.dynamic.:60758 SYN_RECV
tcp 0 0 domain.com:http 89.211.205.59:64217 SYN_RECV
tcp 0 0 domain.com:http CPE-124-187-26-30.qld:ff-sm SYN_RECV
tcp 0 0 domain.com:http frw.Gloworld.com:59104 SYN_RECV
tcp 0 0 domain.com:http 220.255.7.182:winpoplanmess SYN_RECV
tcp 0 0 domain.com:http srisaionline180.excell:1232 SYN_RECV
tcp 0 0 domain.com:http CPE-60-230-16-150.vic:52611 SYN_RECV
tcp 0 0 domain.com:http 203.82.91.102:41318 SYN_RECV
tcp 0 0 domain.com:http 69.171.165.50:32454 SYN_RECV
tcp 0 0 domain.com:http dsl-TN-static-195.:corbaloc SYN_RECV
tcp 0 0 domain.com:http 210.186.66.179:49330 SYN_RECV
tcp 0 0 domain.com:http ABTS-North-D:xinuexpansion3 SYN_RECV
tcp 0 0 domain.com:http c122-106-133-46.livrp:49273 SYN_RECV
tcp 0 0 domain.com:http 173.subnet125-1:nssalertmgr SYN_RECV
tcp 0 0 domain.com:http 121.246.52.30.dynamic:63977 SYN_RECV
tcp 0 0 domain.com:http mobile-3G-dyn-BC-179-1:4464 SYN_RECV
tcp 0 0 domain.com:http crd48.neoplus.adsl.t:aminet SYN_RECV
Following we have done till now is mentioned below for the configurations.
###############
sysctl.conf
##############
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.
# Controls IP packet forwarding
net.ipv4.ip_forward = 0
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
# Controls whether core dumps will append the PID to the core filename
# Useful for debugging multi-threaded applications
kernel.core_uses_pid = 1
# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1
# Controls the maximum size of a message, in bytes
kernel.msgmnb = 65536
# Controls the default maxmimum size of a mesage queue
kernel.msgmax = 65536
# Controls the maximum shared segment size, in bytes
kernel.shmmax = 68719476736
# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 4294967296
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
# Enable IP spoofing protection, turn on Source Address Verification
net.ipv4.conf.all.rp_filter = 1
# Enable TCP SYN Cookie Protection
net.ipv4.tcp_syncookies = 1
# 65536 seems to be the max it will take
net.ipv4.ip_conntrack_max = 1048576
net.ipv4.tcp_rmem = 4096 87380 8388608
net.ipv4.tcp_wmem = 4096 87380 8388608
net.core.rmem_max = 8388608
net.core.wmem_max = 8388608
net.core.netdev_max_backlog = 5000
net.ipv4.tcp_window_scaling = 1
#############
fwsnort, bfd burnintest chkrootkit ddos faf lsm nobody_check sim apf
#############
modsecurity-apache
LoadModule evasive20_module /usr/lib64/httpd/modules/mod_evasive20.so
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 3
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 30
</IfModule>
LoadModule security_module /usr/lib64/httpd/modules/mod_security.so
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 3
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 30
</IfModule>
####################
If the disk of my dedicated server is corrupt and i ask for a new disk+reload of OS, this reload should be free or i have to pay for it? (the server is from layeredtech)
View 8 Replies View Relateddoes anyone of you know a script that bans
a IP that is trying to access a specific file I can manually define?
Is this possible to use Multi-IP to sent out request at the same time?
Scenario
-8 IP is assigned to my box
-I have 8 domains
Now, I would like to connect to a serverX, However, serverX only allow two concurrent connection per IP at the same time.
Is this possible for me to use 8 IPs with 8 Domains to sent out request and having (2X8) = 16 concurrent connection to serverX