Tag Info

Hot answers tagged

34

What you have isn't really a technical problem, it's a management problem, don't try to make it a technical problem. You need to have an acceptable use policy that clearly defines what users can and can't do with the resources provided by your organisation. This should also detail what steps may be taken to enforce the AUP (monitoring usage/auditing machines ...


17

Rule #1 of IP-based networks. Everyone communicating on it has an IP. You can masquerade it through a 3rd party, but you still have a public IP. There are no exceptions. The Internet is an IP-based network. I suspect you have some bad logic in your code someplace.


13

If you are getting a lot of traffic from these spambots, then you are best to drop them at the firewall. Dropping at IIS means putting extra load on your web server (even if it is just serving 403 pages) and if it gets heavy then it could affect the performance for real users of your sites. I'm not intimately familiar with Shorewall but I would also expect ...


8

It is also possible that those variables are just not returning the expected results, and thus are blank. You could try something like this: if ($_SERVER["HTTP_X_FORWARDED_FOR"]) { if ($_SERVER["HTTP_CLIENT_IP"]) { $proxy = $_SERVER["HTTP_CLIENT_IP"]; } else { $proxy = $_SERVER["REMOTE_ADDR"]; } $ip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } ...


8

Fail2Ban. The gold standard/default solution to this problem on the Linux platform.


8

IP Address Range: 119.30.47.0 Mask or Prefix: 255.255.255.0 Other examples: Ban the lower half: 119.30.47.1 - 119.30.47.127 IP Address Range: 119.30.47.0 Mask or Prefix: 255.255.255.128 Ban the upper half: 119.30.47.128 - 119.30.47.254 IP Address Range: 119.30.47.128 Mask or Prefix: 255.255.255.128 In last two examples, the mask ...


7

I think you need to ask Why you are trying to block Facebook? I'm assuming this is a corporate network not home. Why should you allow your staff to use myspace, twitter and amazon, friends-reunited etc but not Facebook? This sort of corporate content filtering (the organisation I work for does this as well) is almost always pointless. It tries to block ...


7

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script). fail2ban will do what you want, with a little more work than reading the Google search tagline.


6

You need to set up an outbound proxy (Threat Management Gateway, Squid, etc) and use Group Policy to force Internet Explorer to pass all traffic though this proxy if it is not in-line. If you make the proxy in-line, then all traffic will, obviously, pass through it regardless of IE settings, making the GPO pointless. You cannot accomplish this natively ...


5

I agree with Sam. It's best to stop them at the perimiter of your network (at the firewall). Think of it like your office building or your home. Do you want to let the rogue into your office and hope that you've got everything inside secured and hope that you haven't forgotten or missed something or would you rather stop them at the door so that they can't ...


5

Shorewall dropping is the best I guess. If you can get the IP addresses of these spammers you can dynamically block them with the command "shorewall drop/reject ipaddress'. You may even write a script which can do this in real time.


5

It sounds like your host has some sort of anti-DOS configuration setup and your customer is triggering it by opening many tabs simultaneously. I'm not surprised if a single tab accessing your system is opening several simultaneous HTTP sessions to download files in parallel - so if your customer has 10 tabs opening at once, as newer browsers offer to do, ...


5

The harder you try to block it, the harder the users will try to get access to it.


5

OpenDNS, or another (and possibly more controlled) option is to build a proxy server between your network and the router. You can do something open source like Squid and an addon for blocking or you can purchase any of many commercial solutions for blocking websites by category. If you're going to be blocking websites, it's generally better in my experience ...


5

The Apache manual section on mod_authz_host is instructive here. The order of your allow and deny statements does not matter. With order allow,deny, you must match at least one allow and no deny directives for your request to be accepted. I think you want order deny,allow.


5

It can be blocked anywhere it passes through, and routers can have routing issues anywhere it passes through. A reasonable conclusion is either that the site is blocking you (possibly for automated reasons) or, more likely, that some router between you and them thinks your IP (or that of the other endpoint) is somewhere it isn't. Also... if you are ...


4

In your httpd.conf you need to ensure that where you have: <Directory /srv/www/dogself.com/public_html/the-real-phpmyadmin-folder> ... </Directory> You add the following: Order deny,allow Deny from all Allow from <your ip> Now no-one can access phpmyadmin unless they're coming from your IP. Another thing you could do is talked about ...


4

Fail2Ban (http://www.fail2ban.org/) can work in conjunction with a firewall such as iptables to monitor log files and automatically add rules to block certain IPs based on various rules e.g. a certain number of incorrect password attempts.


4

Although technically this is a grey-area my own view on this is far more black and white. Ultimately you're running out of IPs because you're targetting emails to people who don't want them, they're complaining and thus the IPs are being removed from your options. There's no real technical way around this, other than moving email provider anyway but even ...


4

yes, use cidr notation in iptables 192.148.10.0/24


4

Netfilter/iptables doesn't scale well when used with higher number of rules as they are supposed to be matched sequentially. But since the Linux kernel 2.6.36, there is a new feature called IP sets which helps to eliminate such rules by using hashing techniques. Briefly, how it works: 1) create an IP set ipset create set01 hash:net 2) add IP ranges to ...


4

What I have seen by trying myself is that restarting the fail2ban daemon doesn't make it reload its configuration file. (Unlike most other daemons under linux... I don't even know how it manages to save its configuration when stopped. Temporary files I guess) The following command will solve your problem : fail2ban-client reload This executable can be ...


4

You are trying to start node as a non-root user. Linux by default only allows root to bind to ports 1024 or below. If you want to run it as this user, you may want to look at http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l


3

What can I do? The old-fashioned means for enforcing similar "productivity policies" remains: get managers watching over employees' shoulders whenever a TPS report is late (or the wrong cover sheet is used).


3

216.231.128.33 - 216.231.128.62 subnet: 216.231.128.32 broadcast: 216.231.128.63


3

Well, for starters (beyond what everyone else said about policy and governance), you should be blocking egress traffic on your network outside of what's required (and I generally don't allow client machines to make direct TCP/UDP connections anywhere; there's no need 99% of the time when you have a proxy server in-house), especially UDP/TCP 53 to outside DNS ...


3

You can possibly use OpenDNS for this - it allows you to block both categories of website and specific urls. http://www.opendns.com You would need to do set DHCP on the router to hand out their DNS server addresses to clients, which should discourage "casual" attempts to surf sites you want to block. If you want something more "hardcore" in terms of ...


3

pretty useful http://www.subnet-calculator.com/


3

There's no built in standard way to achieve this using Group Policy.


3

Yes it can, intermediary devices such as firewalls and routers can have ACL's in place to stop certain IP's from passing through them.



Only top voted, non community-wiki answers of a minimum length are eligible