The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
0answers
40 views

Protect server from uploads

I have NGINX let's say with root /home/leonel/www In the www folder i have the upload.php and dl.php file User uploads to upload.php and upload.php moves the uploaded file to a subfolder of the ...
0
votes
0answers
34 views

Server usage topped 100% and crashed - how to diagnose and prevent

I'm running a small webserver on Ubuntu 12.04. Last night, the server topped off at 100% cpu usage and crashed. This is unusual as I'm normally around 1-5%. I suspect a DDoS attack from someone ...
0
votes
2answers
134 views

How to block requests for virtual hosts that dont exist in apache [duplicate]

First up, check out this question: Why are external domains appearing in my apache logs? We're seeing the exact same thing on one of our Debian VPS servers - with one big difference, the regularity ...
0
votes
1answer
44 views

Network attack on dedicated server [duplicate]

I am using a dedicated server hosting for one of my project. I got a mail from my server provider that their monitoring system noticed a network scan (or network attack) from an IP address. The ...
0
votes
1answer
68 views

What is maximum legitimate SYN traffic rate

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow; ...
2
votes
0answers
31 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
1
vote
1answer
103 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
-1
votes
2answers
124 views

Should I suspicious of this behaviour? [closed]

My website users have perceived that sometimes the server performance is not as it used to be (basically they say that a page that normally loads immediately, could take more than 3 seconds now). This ...
0
votes
1answer
111 views

How to expose securely a Node.js/Express server into the real world?

Essentially I would like to know what the title suggests. Node.js/Express is nice. However, node is a fairly recent thing and hence there may be security risks by exposing the server to the real ...
0
votes
1answer
305 views

Login failed for user 'sa'. … [CLIENT: 59.48.47.215]

I have an Amazon EC2 instance and i don't have anything running on it yet but my event log is full of below error "Login failed for user 'sa'. Reason: An attempt to login using SQL authentication ...
1
vote
0answers
197 views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
-4
votes
1answer
92 views

How to protect against in-RAM attacks

Since hosting providers are constantly under attack from hackers, encryption of the entire file system (the entire server) with tools like www.truecrypt.org seems like an absolute must to me, if you ...
0
votes
1answer
58 views

Are empty HTTP requests malicious?

I have seen multiple empty http request log entries from Apache: HOST:443 REMOTEIP - - [DATA AND TIME] "-" SIZE SIZE "-" "-" Are these malicious attacks, or some misconfiguration on my side?
0
votes
1answer
245 views

Tracking anonymous e-mail threat

A user spoofed/sent an email from http://emkei.cz/ with a very serious threat. Is it possible to trace this back or are we SOL? There wasn't much in the email headers other than that it came from ...
0
votes
3answers
619 views

POP / IMAP server under attack : what risks and how to secure?

Since yesterday (7am), our POP server is under a dictionnary attack : this is what I found in /var/log/mail.log : Mar 26 10:31:36 serv pop3d: LOGIN FAILED, user=monday, ip=[::ffff:91.121.**.***] Mar ...
0
votes
1answer
239 views

How protect from DDOS attack? [closed]

I have many requests with refferer like alexa.com google.com and etc. to main and couple another pages of site. Line from access.log 109.172.15.39 - - [11/Jan/2013:02:30:30 +0400] "GET ...
0
votes
1answer
350 views

Netscan detected from host [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Portscan attacks from somewhere I am using Hetzner's dedicated servers. Today I have got a message: We have received information ...
1
vote
1answer
65 views

Block IPs if they access a resource

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm ...
1
vote
1answer
146 views

Is it normal to collapse VPS CPU with this script?

This is the script, it comes with mod_evasive: #!/usr/bin/perl #test.pl: small script to test mod_dosevasive's effectiveness use IO::Socket; use strict; for(0..100) { my($response); ...
1
vote
4answers
749 views

Solution for DDOS [duplicate]

My server is under DDoS attacks. I see my access log and get something: 968966 93-97-53-41.zone5.bethere.co.uk - - [27/Jul/2011:12:13:58 +0700] "GET /forum/forum.php HTTP/1.1" 200 91231 "-" ...
1
vote
2answers
1k views

Ping O' Death and iptables

Is there a simple rule that can be written to stop a ping o' death with iptables?
2
votes
4answers
857 views

Server FTP attack from multiple IP addresses spanning 5 countries - how can this be?

I recently had an FTP attack where 3 files were copied into public HTML directory of my domain. (It looks like the FTP password was compromised, but I'm still investigating this.) The strange thing is ...