Re: being DOSed
I have found some IPs are opening 10 HTTP connection. Their IPs are changing and all IPs are from different ISP network. What should I do next? Thanks Meimi - Original Message - From: "Tuc" <[EMAIL PROTECTED]> To: "meimi" <[EMAIL PROTECTED]> Sent: Thursday, April 22, 2004 7:29 AM Subject: Re: being DOSed > > > > Hello, > > The bandwidth usage for my server is tripled for 3 hours. When I run > > "top", I find many httpd process in sbwait status. So, I think someone is > > DOSing my server. > > How can I check who is DOSing me? and how can I solve it? > > Thanks > > Meimi > > Quickly : > > netstat -an | sort | grep tcp4|more > > Look for an IP with alot of connections. (We have a script that > actually will count this for us, but its not just for FreeBSD so its > long) > > Tuc/TTSG Internet Services, Inc. > ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
being DOSed
Hello, The bandwidth usage for my server is tripled for 3 hours. When I run "top", I find many httpd process in sbwait status. So, I think someone is DOSing my server. How can I check who is DOSing me? and how can I solve it? Thanks Meimi ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Re: Server down regularly
Hello, > What is the output of uname -a? FreeBSD cp.laws.ms 4.8-RELEASE FreeBSD 4.8-RELEASE #0: Fri May 23 11:13:23 CDT 2003 > Are you patched to the latest security release for 4.8 (p.16 or so)? PHP has been causing people problems lately (see the archives for this list back 30-60 days), could it be biting you? The symptoms sound similar (apache crashing the system). I have checked the dmesg and I found this pid 96448 (httpd), uid 398: exited on signal 6 So, I check the apache error log, and I found this warning repeat many times [warn] child process x did not exit, sending another SIGHUP After that, apache restart. Then another 5 minutes, the servers offline. So, I think you may be right, since I just recompile PHP with lastest PHP stable version (4.3.5). I will search the mail archive now. Thank you for everyone help. You all are very knowledgeable. Thanks Meimi - Original Message - From: "Joshua Lokken" <[EMAIL PROTECTED]> To: "meimi" <[EMAIL PROTECTED]> Sent: Saturday, April 03, 2004 4:44 AM Subject: Re: Server down regularly > * meimi <[EMAIL PROTECTED]> [2004-04-02 12:21]: > > Hello, > > Thanks everyone. > > > > Here is the information > > FreeBSD 4.8 > > Server specification: > > PIII1.7GHz > > 512MB ram > > 80GB harddisk > > > > The server is used for web, mail, dns and databases (mysql and postgresql). > > Recently, I have recompiled PHP with option curl and openssl added. > > The server is in Equinix datacenter and it is not busy, so I don't it will > > be temperature problems. > > > > Actually, what I want to know is the general steps for finding the problems. > > > Well, that's alot of tasks for a single server, but should be alright. > If I wanted to start looking for the source of this problem, I'd first > check /var/log/messages. You'll get a variety of different blurbs in > there, maybe some of which could help you. I'd also check dmesg, to > see if there is hardware or other trouble at boot time: > > # dmesg | more > > > HTH some, > > > -- > Joshua > > Immortality consists largely of boredom. > -- Zefrem Cochrane, "Metamorphosis", stardate 3219.8 > ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Re: Server down regularly
Hello, From the "messages" log, the error I found: /kernel: arplookup xx.xx.xx.xx failed: host is not on local network And warning I got /kernel: WARNING: / was not properly dismounted The first is I have got the wrong netmask, but the error is always in the log and i don't think it is the problem. The second one is just because I issued a reboot from my apc reboot interface. Also, I shouldn't say regularly, it should be frequently. It has been 4 times this weeks. > Do you feel that it is very secure? Anyone else > have access to this box? I am not sure it is very secure and, yes, other people can access but not root access. Thanks Meimi - Original Message - From: "Kevin D. Kinsey, DaleCo, S.P." <[EMAIL PROTECTED]> To: "meimi" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Saturday, April 03, 2004 4:23 AM Subject: Re: Server down regularly > OK, better information now. You said regularly? > What does that mean? Same time every day? > > As someone mentioned, check your log files. > Does it do backups at a certain time, and therefore > crashes (you said it wasn't too heavily burdened) > > Do you feel that it is very secure? Anyone else > have access to this box? > > Kevin Kinsey > > ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Re: Server down regularly
Hello, Thanks everyone. Here is the information FreeBSD 4.8 Server specification: PIII1.7GHz 512MB ram 80GB harddisk The server is used for web, mail, dns and databases (mysql and postgresql). Recently, I have recompiled PHP with option curl and openssl added. The server is in Equinix datacenter and it is not busy, so I don't it will be temperature problems. Actually, what I want to know is the general steps for finding the problems. Thanks Meimi ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Re: Server down regularly
Hello, Thanks everyone. Here is the information FreeBSD 4.8 Server specification: PIII1.7GHz 512MB ram 80GB harddisk The server is used for web, mail, dns and databases (mysql and postgresql). Recently, I have recompiled PHP with option curl and openssl added. The server is in Equinix datacenter and it is not busy, so I don't it will be temperature problems. Actually, what I want to know is the general steps for finding the problems. Thanks Meimi > - Original Message - > From: "Bob Collins" <[EMAIL PROTECTED]> > To: "meimi" <[EMAIL PROTECTED]> > Cc: <[EMAIL PROTECTED]> > Sent: Saturday, April 03, 2004 12:12 AM > Subject: Re: Server down regularly > > > > On Fri, Apr 2, 2004, meimi clacked the keyboard to produce: > > > Hello, > > > My server is down regularly. Could anyone tell what thing I should > check? > > > Thanks > > > Meimi > > > > We could use a little more information. Not to be rude, but are you > > using FreeBSD as an OS? If so, what version? Describe the hardware > > please. Where is the system, is it in a room that is a hundred degrees > > hot? > > > > A shot in the dark: your power supply is going away. Or maybe, bad Ram. > > Well, perhaps an overheating CPU. Maybe an HD that is getting flaky. > > > > Who knows? We need info please to help you. > > > > > > -- > > Bob > > > > "Play is the work of children. It's very serious stuff. And if it's > > properly structured in a developmental program, children can blossom." > > -Bob Keeshan aka `Captain Kangaroo' > > ___ > > [EMAIL PROTECTED] mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to > "[EMAIL PROTECTED]" > > > ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Server down regularly
Hello, My server is down regularly. Could anyone tell what thing I should check? Thanks Meimi ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Server down regularly
Hello, My server is down regularly. Could anyone tell what thing I should check? Thanks Meimi ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
System offline when running portsdb
Hello everyone, My server sudden offline when portsdb is running. I have checked /var/log/messages. But, I couldn't find anything about it. Could anyone what steps I should do to find the error? *I have no phyical access to the server. Thanks Meimi http://www.htmlcss.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
System offline when portsdb is running
Hello everyone, My server suddenly offline when the command `portsdb -Uu`is running. I have checked /var/log/messages. But, I couldn't find why. Could anyone what steps I should do to find the error? *I have no phyical access to the server. Thanks Meimi http://www.htmlcss.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Removing system user
Hello all, I have read some document about server hardening. It suggests me removing the following users: operator, games, news, uucp and following groups: operator, staff I can guess that games is used for playing and news is used for reading news in news group. How about the other? Their descriptions in passwd are not clear. Am I safe to remove them in normal server environment (web, mail, ftp, DNS, SSH)? Thanks meimi http://www.htmlcss.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Newbie question: Imager module and p5-Imager in /usr/ports/
Hello, I have tried to add Perl module "Imager" using CPAN. However, it failed. Then, I find a p5-Imager port. I think they are the same thing, isn't it? Thanks Meimi http://www.htmlcss.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
CVSup newbies question
Hello everyone, I have following the instruction on http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/cvsup.html to install cvsup on my computer. I think CVSup is installed correctly and running smoothly. I am using CVSup to update my port trees. Does that mean I will get all the latest ports in /usr/ports/ after I run cvsup? Thanks Meimi http://www.htmlcss.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
High incoming bandwith
Hello everyone, Today, I found out that my server has unusual high incoming bandwidth usage (4Mbit/s) in some hours. Usually, my server will not have more than 200Kbit/s. How can I check what the cause is? Thanks Meimi ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
Add link request
Hello, My friend have just send an "add link request" to [EMAIL PROTECTED] He follow the instruction in http://www.freebsd.org/commercial/consulting_bycat.html Just after he sent the email, he received this reply: Your mail to 'freebsd-www' with the subject: Adding our company link in Commercial Vendors - Consulting Services Is being held until the list moderator can review it for approval. The reason it is being held: SpamAssassin identified this message as possible spam Either the message will get posted to the list, or you will receive notification of the moderator's decision. If you would like to cancel this posting, please visit the following URL: http://lists.freebsd.org/mailman/confirm/freebsd-www/62ea116adc49abd5a825cb1d435ecfa0c2a42e24 Would the email be really review? Should he resend the email using other smtp server instead of his ISP's smtp server? Thanks meimi ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
