15

Please look carefully at the processlist and the 'show engine innodb status'. What do you see ??? Process IDs 1,2,4,5,6,13 are all trying to run COMMIT. Who is holding up everything ??? Process ID 40 is running a query against large_table. Process ID 40 has been running for 33 seconds. Process IDs 1,2,4,5,6,13 having been running less than 33 seconds. ...


11

Yes, this is a valid way to check that the socket is non-blocking. The value for a non-blocking socket is 04000, non-blocking sockets in /proc/<pid>/fdinfo are represented in octal. You can validate this behaviour with python. Python 2.7.5 (default, Feb 19 2014, 13:47:28) [GCC 4.8.2 20131212 (Red Hat 4.8.2-7)] on linux2 Type "help", "copyright", "...


8

cjc put me on the right track. Using access_log in an if statement by itself is not possible (You get a nginx: [emerg] "access_log" directive is not allowed here error). So the workaround is as follows: if ($http_user_agent ~* (crawler) ) { set $crawler 'yes'; } location ~ .* { if ($crawler = 'yes') { access_log /var/log/nginx/blockedbots.log; ...


7

Driving straight into the details, let's convert both 42.1.0.0 and 2a01:1e8 into binary (you'll see why I only chose the initial portion in a moment.) 0010 1010 . 0000 0001 . 000 | 42 . 1 . 0 | 0010 1010 0000 0001 : 000 | 0 0001 1110 1000 2a01 : | 1e8 | ^ cut ...


7

The correct setting Microsoft added for what you need is AppLocker by GPO. You can add policy by filehash, filepublisher or path. With the filehash, it's harder for an user to bypass it, unless he get another version, but you could block the publisher too.


6

For the love of God, package your app with a local copy of the Java binary if your app needs a specific version. Don't rely on the system-installed binary. This prevents the users from being able to update their Java browser plug-ins. With the recent major vulnerabilities in Java lately, I'd stop using your product immediately if you told me I couldn't ...


6

You're Doing It Wrong my friend. Aside from both local NAT and "Carrier-Grade NAT" (which mean the information you get from ifconfig on client systems may be a private address that you can't use in your server's access lists), IP-based security is a farce: ISPs may change public network assignments, end-users may be on dynamic IPs, or someone might spoof ...


5

If you want to block an IP from using the MASQUERADE rule you need to put that rule in the FORWARD chain, not the INPUT chain. iptables -I FORWARD -s 69.171.229.11 -j DROP


5

One of the simplest ways is to set up a squid proxy, and put rules in place to allow only the site you want. Then block access to all ports on your firewall for LAN PCs (you may need to consider if your clients need to access any other internet services). Finally, push out proxy info using wpad.dat or dhcp option 252, both of which should work for linux I ...


5

access_log supports if: (access_log path [format [buffer=size [flush=time]] [if=condition]];) access_log /var/.... if $crawler; Source: http://nginx.org/en/docs/http/ngx_http_log_module.html


5

You can't do this at the firewall layer (well, you can - but it won't accomplish what you think it will, nor what you want). The second packet (which you desire) is part of the same TCP stream as the first packet (which you don't want), and TCP is a reliable delivery mechanism. That means that the OS knows if a packet in the middle of the stream has gone ...


4

You should be able to put an access_log directive inside an if block, according to the documentation: http://wiki.nginx.org/HttpLogModule So, you should be able to do something like: if ($http_user_agent ~* (crawler) ) { access_log /path/to/other/log/file ; }


4

There are two ways to do this: 1) Block it at the firewall, based on the destination IP address and port. For example, when I look up YouTube from my location I get: C:\Users\mark.henderson>nslookup Default Server: enetsdc2.enets.local Address: 192.168.161.2 > youtube.com Server: enetsdc2.enets.local Address: 192.168.161.2 Name: youtube.com ...


4

So… you're redirecting the real Google site and complaining when Google's browser notices that you've intercepted Google's website? Build Chrome from source and deploy that to your Enterprise. Or stop using OpenDNS.


4

If you want to block blank user agents by sending them a "403" or access denied message then this should work: if ($http_user_agent = "") { return 403; } Modifying this to do other things should be straightforward.


4

This question is old, but in case someone else runs into this problem: Your problem comes from the fact that tcp-request content runs before HAProxy has had time to receive/read any layer 7 data. How to fix this? Easy: add a tcp-request inspect-delay: listen http 0.0.0.0:80 tcp-request inspect delay 15s acl abuser hdr_sub(user-agent) -f /etc/...


3

#1 WP Plug-in Wordpress, check out the follow, you may or may not need a plug-in Read this link discuss various WP anti-spam plugin and tuning WP setting so you don't need plugin. Top 10 WP Anti-spam plugin Wordpress plugin page Since you do have control over the web server, installing plugin should be no problem. #2 IIS Web.config IP base blocking can ...


3

Solved! The main problem was query_cache. http://bugs.mysql.com/bug.php?id=21074 After disabling it the 'freezes' dissapeared.


3

If it's a true DoS, this isn't going to help much. The requests are still going to clog your pipe whether your server answers or not. By dropping that traffic, you're just delaying the inevitable exhaustion of resources. To truly combat a real DoS, you should contact your ISP and ask then to drop the offending traffic while it's still on their backbone ...


3

robots.txt doesn't block anything, it is up to the crawler whether it pays attention to robots.txt or ignores it. There's also no central list of web crawlers, since anyone can run one for any reason and they can appear as ordinary browsing traffic, claiming to come from an ordinary web browser. You can do basic referrer checks to block image hotlinking, ...


3

You need the equivalent to this in your distro: $ apt-cache show xtables-addons-common Package: xtables-addons-common Description-en: Extensions targets and matches for iptables [tools, libs] Xtables-addons provides extra modules for iptables not present in the kernel, and is the successor of patch-o-matic. Extensions includes new targets like TEE, ...


3

This is, perhaps, a bit too obvious of a statement, but the blocking behavior has to be based on the information that the remote server is privy to. That would include: The source IP address The source TCP port, which should be ephemeral and changing on each request There's probably some passive fingerprinting of the client's IP stack that's possible The ...


2

I'm a little embarrassed to admit that I've done this before, but the "cheapest" way I've found to do this (assuming the user can't install or otherwise use third-party web browser software) is to use Group Policy to configure Internet Explorer to use a bogus HTTP / HTTPS proxy server (i.e. an IP / port that doesn't answer-- preferably one that actually ...


2

OpenDNS Enterprise is one solution you might consider.


2

Your kernel is not crashing. Are you running postfix? This is the only (common) program I'm aware of that has an executable called 'bounce'. It looks like bounce is waiting for a read/write/flock to complete, indeed, looking at the stack, it appears to have gone to sleep at ext3_sync_file() Is the filesystem mounted with the sync option? Although ...


2

You can't shut down port 25 for your SBS server because, as others have mentioned, that will shut down outgoing mail from Exchange. It sounds like the 2 ISA rules you have for SMTP have it covered. If I remember correctly (this is going back a ways) ISA operates with a deny all by default mentality and you have to open what you need opened. From that ...


2

I've had clients in similar situations, usually the SBS server itself isn't the actual source of the infection. It was either a client machine sending out on port 25 directly or it was using the exchange server as a relay to get out. Usually within your firewall you want to block port 25 for everything (preferrably block all ports from wan to lan) and then ...


2

Take a look at ipset I think this is exactly what you are looking for. ipset extension


2

According to the mysql documentation, the 'opening tables' state shouldn't be seen unless there are locks getting in the way, or when your table_open_cache is too small. Check mysql's errorlog to find out what happened, check the show engine innodb status output for innodb info.


2

You are basically asking to break SSL security with your suggestion. Chrome has the feature called pinned certificates, where well-known website certificates are stored inside the browser. It means that whenever some other certificate than the one for the desired destination is presented, the browser gives out a warning about a Man in the middle attack. ...


Only top voted, non community-wiki answers of a minimum length are eligible