vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vB4 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=251)
-   -   Help! Server Attack (https://vborg.vbsupport.ru/showthread.php?t=275851)

Rocket1 12-22-2011 09:25 PM

Help! Server Attack
 
On a non-managed Linux dedicated via GoDaddy. We have had an issue over the last two weeks with our server shutting down. Below is a response from the server peeps on the cause. Any suggestions would be greatly appreciated.

=============================

First off we are showing a large number of failed log in attempts and failed DNS lookups. These are results of attackers attempting to brute force your password, and domains resolving to your servers IP. You should be able to block most of this traffic through firewall rules.

The second issue, is that your mysql service is consuming 100% of the cpu, and you are maxing out your email relays. Normally these would be separate issues but they are directly related to each other. The reason why your email relays are getting maxed out is that your server is trying to send you email notices that your vbulletin database queries are failing. These same database queries are causing your mysql service load to spike.

My suggestion would be to review online for ways to harden a Linux server. This will provide you with suggestions on changes you can make to your server configuration that would make it so attacks against the server do not have as much of an effect on the operating level of the server.

==================

Anyone have any tricks to help out with this?

MegaManSec 12-23-2011 11:16 AM

I can help with this, I have alot of experience when it comes to security, DOS, and hacking in linux.
If you trust me, PM me your ssh details, and I'll set it all up.(then I'll tell you what I did)
If not,

Download ddosdeflate, turn off emailing on mysql error, iptables the attackers, etc etc..

Thanks, loaep

doopz 12-23-2011 12:17 PM

Quote:

Originally Posted by loaep (Post 2280381)
I can help with this, I have alot of experience when it comes to security, DOS, and hacking in linux.
If you trust me, PM me your ssh details, and I'll set it all up.(then I'll tell you what I did)
If not,

Download ddosdeflate, turn off emailing on mysql error, iptables the attackers, etc etc..

Thanks, loaep

Hmm, how about he fixes the problem of why vbulletin is sending out MySQL errors ? That seems like a better suggestion to me.

Close down services such as FTP/SSH and only allow them for your own IP(s). You can also try and disable DNS lookups for them, but i suspect that closing down the hammered services will be enough.

I'm available for help if you need it.

MegaManSec 12-23-2011 12:20 PM

Quote:

Originally Posted by doopz (Post 2280398)
Hmm, how about he fixes the problem of why vbulletin is sending out MySQL errors ? That seems like a better suggestion to me.

Close down services such as FTP/SSH and only allow them for your own IP(s). You can also try and disable DNS lookups for them, but i suspect that closing down the hammered services will be enough.

I'm available for help if you need it.

most likely because the error is 'mysql is gone' aka. there is no mysql server, because the ram is @ 100%..
you cant stop that.
You can however block the ip's, and set up a script to automaticly do it.


All times are GMT. The time now is 10:34 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.00938 seconds
  • Memory Usage 1,718KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (2)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (4)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete