Getting these emails, several a day telling me that the server is banning its own allocated IP addresses. Can someone explain what on earth it could possibly be doing to ban its own IP's?
From - Thu Dec 20 16:50:47 2007
X-Account-Key: account3
X-UIDL: GmailId116f88c2a1c060ca
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Delivered-To: myemail@gmail.com
Received: by 10.90.78.14 with SMTP id a14cs288558agb;
Thu, 20 Dec 2007 09:14:04 -0800 (PST)
Received: by 10.142.177.7 with SMTP id z7mr183490wfe.47.1198170843836;
Thu, 20 Dec 2007 09:14:03 -0800 (PST)
Return-Path: <root@host.domain.com.br>
Received: from server.domain.com.br (domain.com.br [xxx.xxx64.138])
by mx.google.com with ESMTP id m8si38592roe.1.2007.12.20.09.14.03;
Thu, 20 Dec 2007 09:14:03 -0800 (PST)
Received-SPF: pass (google.com: domain of root@server.domain.com.br designates xxx.xxx.64.138 as permitted sender) client-ip=xxx.xxx.64.138;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of root@server.domain.com.br designates xxx.xxx.64.138 as permitted sender) smtp.mail=root@server.domain.com.br
Received: from root by server.domain.com.br with local (Exim 4.68)
(envelope-from <root@server.domain.com.br>)
id 1J5OyA-0004us-63
for root@server.domain.com.br; Thu, 20 Dec 2007 15:13:39 -0200
To: root@server.domain.com.br
Subject: IP addresses banned on Thu Dec 20 15:13:39 BRST 2007
Message-Id: <E1J5OyA-0004us-63@server.domain.com.br>
From: root <root@server.domain.com.br>
Date: Thu, 20 Dec 2007 15:13:39 -0200
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.domain.com.br
X-AntiAbuse: Original Domain - server.domain.com.br
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - server.domain.com.br
Banned the following ip addresses on Thu Dec 20 15:13:38 BRST 2007
xxx.xxx64.138 with 151 connections
I have centos 4 / cpanel installed with apf / bfd yet the deny host rules for apf does not show the server IP's listed as banned.
I then turned on the brute force protection cPanel provides, and it went down considerably from there. I'm not concerned at all about it (since the passwords are strong), but I would like to know the best way to determine abusive users (of SSH), and the best way to ban them.
Assuming the server does not have APF installed, or any particular control panel...
I need to ban IP range and I inserted say ip 12.44.0.0 in the deny_hosts rules, this should ban range from 12.44 but strange is people from that range still be able to access my site, any idea what went wrong?
my VPS provided didn't enable a lot of modules and that's why I can use a firewall(csf or apf) and dos deflate script
I need a simple script for it.
First,it has to call this: netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n then there will be something like: Number : IP address 20 1.2.3.4 40 1.2.3.5 80 1.2.3.6 and then the bash script has to bann IPs with more than 30 connections(In our case: 1.2.3.5 and 1.2.3.6) with this: iptables -A INPUT -s IP_FOR_BLOCK -j DROP
I want to stop users from country X from accessing my website, I know I can ban people's IPs but I dont know if it is possible to ban certain geographical area and if so, I haven't got a clue about how to do it.
I installed mod_security and the 403security rules on my VPS (Centos 4.1, Release version of WHM).
Several vBulletin files, including the ajax quick editor and some vbulletin.org add-ons are triggering this rule and banning members' IPs in CSF:
# Restrict witch content encodings we accept. # # TODO Most applications support only two encodings for request bodies # because that is all browsers know how to produce. If you are using # automated tools to talk to the application you may be using other # content types and would want to change the list of supported encodings. # # Note though that ModSecurity parses only three content encodings: # application/x-www-form-urlencoded, multipart/form-data request and # text/xml. The protection provided for any other type of encoding is # inferior. # # TODO There are many applications that are not using multipart/form-data # encoding (typically only used for file uploads). This content type # can be disabled if not used. # # NOTE We allow any content type to be specified with GET or HEAD # because some tools incorrectly supply content type information # even when the body is not present. There is a rule further in # the file to prevent GET and HEAD requests to have bodies to we're # safe in that respect. # # NOTE Use of WebDAV requires "text/xml" content type. # # NOTE Philippe Bourcier (pbourcier AT citali DOT com) reports # applications running on the PocketPC and AvantGo platforms use # non-standard content types: # # M-Business iAnywhere application/x-mal-client-data # UltraLite iAnywhere application/octet-stream # SecRule REQUEST_METHOD "!^(?:get|head|propfind|options)$" "chain, t:lowercase, deny,log,auditlog,status:501,msg:'Request content encoding is not allowed by policy',id:'960010',severity:'4'" SecRule REQUEST_HEADERS:Content-Type "!(?:^(?:application/x-www-form-urlencoded$|multipart/form-data;)|text/xml)" I don't know how to decipher this rule to know if just removing it is ok, or if it is serving an important purpose. During a couple hour period it was enabled, that rule only seemed to trigger false alarms.
The above was triggered with calls such as [uri "/forums/ajax.php?do=usersearch"] and [uri "/forums/newreply.php?do=postreply&t=11057"]
What I really don't understand is that I have an .htaccess in place to turn off mod_security for the /forums directory:
<IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule> I have also had this rule triggered today when someone tried to access : ...
for over a year now, with iptables. However recently, after upgrading to apache 2.2, the connections in netstat get listed as ipv6. A row can look like this for example:
As you can see, the remote ip address isn't complete, it's cut off, so the script used to sum up connections and insert into iptables isnt doing anything.
[mysqld] datadir=/var/lib/mysql socket=/var/lib/mysql/mysql.sock # Default to using old password format for compatibility with mysql 3.x # clients (those using the mysqlclient10 compatibility package). old_passwords=1
I have Plesk 11.5 (service provider mode) on a Windows 2008 server IIS7.Most of my sites are developed in .asp and therefore i use a custom 500-100.asp error page that check s the IP of the visitor then displays either a friendly error, or if its my IP a full error of what has happened (it also emails me the error). This allows me to debug pages easily whilst developing and to keep an eye on anyone trying SQL Injection hacks on my sites (as the error and email also have session variables and IP address).I dont have root access to the server as it is a Webfusion dedicated server.I have following the Plesk documentation -
1) Switch on custom errors for the subscription 2) Look in virtual directories and navigate to error documents 3) Find the error in question (500:100) and change it to point at either a file or URL
FILE - I had the data centre add in the 500-100.asp error page in to the virtual template so that my page is available in the list of virtual files - this didn't work but that maybe because its not a static page??
URL - when i add the path it says its incorrect, if i add a fully qualified address, it accepts it but it doesn't work.give me a specific example of the URL that can be entered relative to the root as the format in the documentation isn't accepted. The last step is to restart IIS which is also an issue as i cant seem to do this from the Plesk panel..It is as if it isn't catching the 500:100 error, and only catching the general 500 error??
I am currently running Google Analytics/Urchin 5 (v5.7.02), on a server, the server has started to act up, (on its last legs etc) and now I am trying to transfer the Urchin Software to a new server, where it would work effectively.
However upon installing the urchin software on the new server and running it (localhost:9999), I am presented with An Action Items Page, and these following choices
This is the scenario, domain.com are setup on server1, however server2 also has the same profile of domain.com as we use ns3 and ns4 using domain.com. This works fine with the nameserver setup on server2.
However I encounter problems as the emails from server2 won't reach server1 as there are duplicate profile on server2.
My question is how do I setup the DNS in cpanel/whm from server2 so the emails from server2 will reach server1?
I just want to use a server for file sharing, it will have nginx and that's it. I'm looking at centos, or freebsd, but I been using centos forever now and I'm not sure how to use freebsd, should I just stay with centos?
Do I tell my hosting provider to just install the OS and give me ssh action and that's it? Don't install any control panels or any other stuff? I want one domain and one subdomain on it though and ftp action.
I'm wondering whether it is possible to perform a full server migration to a new Plesk server with the same hostname or will Plesk give an error about the hostname being the same?
The new server would not be accessible by hostname (only via IP) until DNS and glue records were changed after the migration.
I've been developing a small 2D MMORPG lately. I bought a VPS to run the server on a few days ago and sadly it doesn't work so well. Sometimes the loads go pretty high (afaik not caused by me) and MySQL freezes, causing the server to just wait for MySQL to unlock, hanging all the players around on the map. Not a good thing.
Anyway, the game is very small scale, and I'm not planning to have more than maybe 30-50 players online. It does not suck up much CPU, I had ~10 guys online and loads stayed down at 0.00 on the VPS box.
Problem with getting a dedicated is our very low budget. As I'm still underage and living at home hammering my pc and don't have any real incomes, we're talking numbers like $ 30 - $ 50 USD per month - it's really hard to find for that price in Europe.
Requirements: Monthly payment, $ 30 - $ 50 / month, no setup (or very small setup, like $ 20) 10Mbit/s or faster connection, 100GB traffic should do 500MHz CPU is all cool 512MB or more RAM 5GB diskspace is enough Has to be in Europe due to ping times (< 100ms) Linux, Debian 4.0 prefered
If anyone knows where I could get something like this for a low price, $ 30 to $ 50 USD, it'd be great.
I have been searching everywhere trying to find a tutorial but It is not going anywhere. Basically I need to create 2 nameservers for Godaddy and pretty much so when i type http://mysite.com it goes to my site. I can access everything from http://myip and everything works. Now is there a step by step on how to actually do it in the DNS Manager? I need help like what IP address do I use is it the router ip? The external IP?
Site is currently running on a single code single cpu p4 server. Am thinking of upgrading to a quad core Xeon server.
My site is pretty dynamic with lots of hits to php / mysql, and has trouble keeping up with the requests sometimes. Would a quadcore Xeon significantly help?
Server Software: Windows 2003 Server php 5.2.6 apache 2 mysql 4.1
Current Setup: P4 2.8 single core/cpu.
Proposed setup Xeon 3210 quadcore
I guess my confusion lies in the following:
1. Can win2003 server make use of the quadcores? 2. Does php / apache / mysql make use of the quadcores? 3. Will i see a significant increase in the amount of pages i can serve?
I am going to be buying a dedicated server from kimsufi Most likely the 2XL Package.
My streamers will be using my server aswell, On weekends we will be running 3-4 streams at a time, weekdays 1-2 at a time.
Spreading all the streams out, at anyone time we will have 300 viewers.
I need to know your advice on this before i go spending money.
How do i convert my dedi into a flash media server, i need red5 or something, thats all i know so far. My streamers wil be streaming to server with FME, And i also want it coded so that my streams can only be embedded on my site.
Basically i dont have a clue where to start, how long would it take me to set up etc....
In addition, what kind of server do i need, windows / linux / traffic / burstable / standard etc..
