Tag Info

Hot answers tagged

34

What you have isn't really a technical problem, it's a management problem, don't try to make it a technical problem. You need to have an acceptable use policy that clearly defines what users can and can't do with the resources provided by your organisation. This should also detail what steps may be taken to enforce the AUP (monitoring usage/auditing machines ...


17

Rule #1 of IP-based networks. Everyone communicating on it has an IP. You can masquerade it through a 3rd party, but you still have a public IP. There are no exceptions. The Internet is an IP-based network. I suspect you have some bad logic in your code someplace.


13

If you are getting a lot of traffic from these spambots, then you are best to drop them at the firewall. Dropping at IIS means putting extra load on your web server (even if it is just serving 403 pages) and if it gets heavy then it could affect the performance for real users of your sites. I'm not intimately familiar with Shorewall but I would also expect ...


8

It is also possible that those variables are just not returning the expected results, and thus are blank. You could try something like this: if ($_SERVER["HTTP_X_FORWARDED_FOR"]) { if ($_SERVER["HTTP_CLIENT_IP"]) { $proxy = $_SERVER["HTTP_CLIENT_IP"]; } else { $proxy = $_SERVER["REMOTE_ADDR"]; } $ip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } ...


7

IP Address Range: 119.30.47.0 Mask or Prefix: 255.255.255.0 Other examples: Ban the lower half: 119.30.47.1 - 119.30.47.127 IP Address Range: 119.30.47.0 Mask or Prefix: 255.255.255.128 Ban the upper half: 119.30.47.128 - 119.30.47.254 IP Address Range: 119.30.47.128 Mask or Prefix: 255.255.255.128 In last two examples, the mask ...


7

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script). fail2ban will do what you want, with a little more work than reading the Google search tagline.


7

I think you need to ask Why you are trying to block Facebook? I'm assuming this is a corporate network not home. Why should you allow your staff to use myspace, twitter and amazon, friends-reunited etc but not Facebook? This sort of corporate content filtering (the organisation I work for does this as well) is almost always pointless. It tries to block ...


6

You need to set up an outbound proxy (Threat Management Gateway, Squid, etc) and use Group Policy to force Internet Explorer to pass all traffic though this proxy if it is not in-line. If you make the proxy in-line, then all traffic will, obviously, pass through it regardless of IE settings, making the GPO pointless. You cannot accomplish this natively ...


6

Fail2Ban. The gold standard/default solution to this problem on the Linux platform.


5

It can be blocked anywhere it passes through, and routers can have routing issues anywhere it passes through. A reasonable conclusion is either that the site is blocking you (possibly for automated reasons) or, more likely, that some router between you and them thinks your IP (or that of the other endpoint) is somewhere it isn't. Also... if you are ...


5

OpenDNS, or another (and possibly more controlled) option is to build a proxy server between your network and the router. You can do something open source like Squid and an addon for blocking or you can purchase any of many commercial solutions for blocking websites by category. If you're going to be blocking websites, it's generally better in my experience ...


5

The Apache manual section on mod_authz_host is instructive here. The order of your allow and deny statements does not matter. With order allow,deny, you must match at least one allow and no deny directives for your request to be accepted. I think you want order deny,allow.


5

Shorewall dropping is the best I guess. If you can get the IP addresses of these spammers you can dynamically block them with the command "shorewall drop/reject ipaddress'. You may even write a script which can do this in real time.


5

I agree with Sam. It's best to stop them at the perimiter of your network (at the firewall). Think of it like your office building or your home. Do you want to let the rogue into your office and hope that you've got everything inside secured and hope that you haven't forgotten or missed something or would you rather stop them at the door so that they can't ...


5

It sounds like your host has some sort of anti-DOS configuration setup and your customer is triggering it by opening many tabs simultaneously. I'm not surprised if a single tab accessing your system is opening several simultaneous HTTP sessions to download files in parallel - so if your customer has 10 tabs opening at once, as newer browsers offer to do, ...


4

The harder you try to block it, the harder the users will try to get access to it.


4

Although technically this is a grey-area my own view on this is far more black and white. Ultimately you're running out of IPs because you're targetting emails to people who don't want them, they're complaining and thus the IPs are being removed from your options. There's no real technical way around this, other than moving email provider anyway but even ...


4

In your httpd.conf you need to ensure that where you have: <Directory /srv/www/dogself.com/public_html/the-real-phpmyadmin-folder> ... </Directory> You add the following: Order deny,allow Deny from all Allow from <your ip> Now no-one can access phpmyadmin unless they're coming from your IP. Another thing you could do is talked about ...


4

Fail2Ban (http://www.fail2ban.org/) can work in conjunction with a firewall such as iptables to monitor log files and automatically add rules to block certain IPs based on various rules e.g. a certain number of incorrect password attempts.


4

yes, use cidr notation in iptables 192.148.10.0/24


4

Netfilter/iptables doesn't scale well when used with higher number of rules as they are supposed to be matched sequentially. But since the Linux kernel 2.6.36, there is a new feature called IP sets which helps to eliminate such rules by using hashing techniques. Briefly, how it works: 1) create an IP set ipset create set01 hash:net 2) add IP ranges to ...


4

What I have seen by trying myself is that restarting the fail2ban daemon doesn't make it reload its configuration file. (Unlike most other daemons under linux... I don't even know how it manages to save its configuration when stopped. Temporary files I guess) The following command will solve your problem : fail2ban-client reload This executable can be ...


4

You are trying to start node as a non-root user. Linux by default only allows root to bind to ports 1024 or below. If you want to run it as this user, you may want to look at http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l


3

User Agent string matching is not reliable method, as anyone can change it on headers. From my experience, every internet facing webserver is akin to be crawled and surfed (that's THE point, right? :). If anything, they're just crawling your webserver for indexing of some sort. If you want to frustrate or limit the frequency for those requests, I'd suggest ...


3

The more effective way is to block them in Windows Firewall. That has nothing to do with local security policy, other than perhaps pushing out the firewall rule to multiple Windows computers. The path to that policy is Computer Configuration >> Administrative Templates >> Network >> Network Connections >> Windows Firewall. The most effective way is to block ...


3

You should not rely on blocking specific IP addresses to mitigate hacking attempts. To make your system secure, it should be protected against hacking from ANY IP address. You should block access to all ports except for the ports which are used. For example, when you provide a web service, allow port 80, and only allow it to communicate directly with a web ...


3

Is there any particular reason why your server has to answer to external queries at all ? Ideally, you would setup an external resolver for your public resolver (used to resolve all resources that must be accessed externally: MX, web server, etc), use the windows DNS server only for your internal network and block all incoming DNS queries at your perimeter. ...


3

Well, for starters (beyond what everyone else said about policy and governance), you should be blocking egress traffic on your network outside of what's required (and I generally don't allow client machines to make direct TCP/UDP connections anywhere; there's no need 99% of the time when you have a proxy server in-house), especially UDP/TCP 53 to outside DNS ...


3

216.231.128.33 - 216.231.128.62 subnet: 216.231.128.32 broadcast: 216.231.128.63


3

pretty useful http://www.subnet-calculator.com/



Only top voted, non community-wiki answers of a minimum length are eligible