john_r_h wrote:
Regarding ping, I have a cron-script running from a different site that pings this box only oncer per minute, so I don't think I am hitting it too hard.
Could be pings from someone else. That rule doesn't discrimate based on IP, it applies to all incoming packets.
Quote:
As for the blocked login, I am not sure what is meant by "blocked you".
From
http://configserver.com/cp/csf.html:
"To complement the ConfigServer Firewall (csf), we have developed a Login Failure Daemon (lfd) process that runs all the time and periodically (every X seconds) scans the latest log file entries for login attempts against your server that continually fail within a short period of time. Such attempts are often called "Brute-force attacks" and the daemon process responds very quickly to such patterns and blocks offending IP's quickly. "
It's almost certainly using iptables for doing the actual blocking, so the next time you get blocked you should be able to login via Lish and unblock yourself by deleting the iptables rule. Talk to your contractor for more information.
Quote:
If ping and login attempts can result in taking the server offline like this then I am sunk. Right?
No. ICMP echo packets can usually be blocked completely without adversly affecting a server. I'm not saying that's a good idea (since you lose the ability to troubleshoot with ping), but just because a server can't be pinged doesn't mean it's offline.
Also, the lfd blocks are per-IP if I'm reading the docs right, so it only makes the server inaccessible to you, not anyone else.
FAQ
Search
Members
Register
Login [ Anonymous ]
