http://vietvuive.com - Lowlife scumbag

[whitey]

FB:

Ok, since you are on an unmanaged server, I am going to assume that you have not installed a firewall. I am going to suggest that you use apf because it is open source and it works.

There is an excellent tutorial on installation of apf here..

http://www.webhostgear.com/index.php?art/id:61

If you have trouble getting the page to load (Brett updated that site recently with new software and it is loading slowly), I am going to take the liberty of copying it for you below due to the urgency of the issue you are experiencing (btw, logon to your ssh as root or the root substitute if you set one up).
---------------------------------

What is APF (Advanced Policy Firewall)? APF Firewall
APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux. APF is developed and maintained by R-fx Networks: http://www.rfxnetworks.com/apf.php

This guide will show you how to install and configure APF firewall, one of the better known Linux firewalls available.10

Limit SSH connections to one IP with APF in this advanced tutorial

Requirements:
- Root SSH access to your server

Lets begin!
Login to your server through SSH and su to the root user.

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz



Article provided by WebHostGear.com


3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.

Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/

Other Details:
Listening TCP ports: 1,21,22,25,53,80,110,111,143,443,465,993,995,2082,2083,2086,2087,2095,2096,3306
Listening UDP ports: 53,55880
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

6. Lets configure the firewall: pico /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn't a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

We like to use DShield.org's "block" list of top networks that have exhibited
suspicious activity.
FIND: USE_DS="0"
CHANGE TO: USE_DS="1"

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43,2089"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"


Ensim Servers
We have found the following can be used on Ensim Servers - although we have not tried these ourselves as I don't run Ensim boxes.

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,19638"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

Save the changes: Ctrl+X then Y


8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|--start ......................... load firewall policies
-r|--restart ....................... flush & load firewall
-f|--flush|--stop .................. flush firewall
-l|--list .......................... list chain rules
-st|--status ....................... firewall status
-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall


9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM="1"
CHANGE TO: DEVM="0"


10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

pico /etc/apf/ad/conf.antidos

There are various things you might want to fiddle with but I'll get the ones that will alert you by email.

# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME="Your Company"
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT="0"
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR="your@email.com"
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
tail -f /var/log/apf_log

Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123


12. New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:

chkconfig --level 2345 apf on

To remove it from autostart, run this:

chkconfig --del apf


13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I'll show you 2 of the easier methods.

A) /etc/apf/apf -d IPHERE COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> IPHERE is the IP address you wish to block
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being blocked
These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -d 185.14.157.123 TESTING

pico /etc/apf/deny_hosts.rules

Shows the following:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules

You can then just add a new line and enter the IP you wish to block. Before this becomes active though you'll need to reload the APF ruleset.

/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)

I know I know, you added an IP now you need it removed right away! You need to manually remove IPs that are blocked from deny_hosts.rules.
A)
pico /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

/etc/apf/apf -r

B) If the IP isn't already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123


Thanks to R-fx networks for developing and maintaining APF Firewall. Written by Steven Leggett of WebHostGear.com

-----------------------------------------

Now, FB, a couple of notes to make this easier..

Using Steven's suggested ingress and egress ports generally works fine so do not stress about it. Note that he only provides those, however, for Cpanel and Ensim WHM applications. If you use Plesk, you will may either have to experiement or search the web (or the forums at the planet "forums.theplanet.com") for suggested ingress and egress port settings. If you do not have a WHM (cpanel, ensim or Plesk) console installed, change server suppliers as Apache 2's use of else/if commands makes it enormously difficult to operate completely old school/naked and you want to be a pornographer and not a tech guy.

Make certain to activate the autostart on reboot as apf will turn off each time your server goes down - even if for a minute.

Make certain you add your own ip c-class to the allow_hosts.rules

Make certain to test the firewall and your access to the server root prior to activating the firewall permanently (see #9 above). I made the mistake of not testing once and got locked out of a server.

I use a nano text editor in which case change the "pico" commands to nano (or "vi" if you are old school)

If you have problems or need additional information, PM me and I will help you.

[whitey]

FB:

Once you have installed apf, you now want to deny the bastard from getting your site.

There is an excellent tutorial on this at..

http://www.webhostgear.com/209.html

If the page does not load for you, I have copied the contents below...

_------------------------

Have a user that keeps hammering your FTP or trying to login over and over and over again that you just want to ban and never see again? We'll show a quick and dirty method to ban an IP address from the server.

We commonly receive questions like:
"I would like to ban that ip address to prevent the access to the server.

how can i ban that Ip address from the server?"

Simple!

1) Login to the server as and su - to root.

2) If you are running iptables, you can enter:

iptables -A INPUT -s <IP> -j DROP

3) If you have APF firewall installed

apf -d <ip>

4) When you reboot this IP ban will be removed, meaning the IP will no longer be banned anymore.
If you have APF you can get around this by opening the deny hosts file.

pico /etc/apf/deny_hosts.rules

Scroll to the bottom and paste in the IP address.
Ctrl+X then Y to save the changes and exit.

5) Restart APF
/etc/apf/apf -r


---------------------------

A personal note:

Just putting the ip in the apf deny_hosts.rules should work. If not, you can do 2 and 3 as well.

I would ban a range of ips around this bastards ip (i.e. xxx.xxx.xxx/24 starting a few ips before his).

If this does not work, let me know as there are other, more dastardly, ways to stop this. This should, however, accomplish your objectives.

For unmanaged dedicated servers, I really recommend two places: The Planet (theplanet.com). Quite a few hosts use their datacenter and servers, and there is a reason for that. If you are using someone like Superb that offers $59 per month Celeron servers, look at the deals at the Planet which are recirculated servers; they will work until you are generating more cash and they normally defualt to a 100mbs pipe. Most really low end unmanaged suppliers put you on a 10 mbs pipe. The Planet will not offer support if you bother them alot, but the guys will help in a pinch. They also offer different levels of server support (I pay them to do custom kernels for me). Even if they will not help (if you are on an unmanaged server), they normally will give you some direction to find the solution (link, key issue to search for).

The other place I have servers is at liquidweb.com. More expensive, but their version of an unmanaged server is everyone else's version of managed and their team is exceptional.

At the planet, you can get a decent server with 750 to 1000 gigs of transfer per month for $100; liquidweb is about $175 with 750 gigs. Both offer unmetered pipes at industry low prices and both have exceptional tier one redundancy.

If you are in Europe and sans credit card, both will work with you on pay-pal plans I believe. Both serve large customer bases outside the US (the planet boasts that 50% of their customers are non-US based) and are accustomed to working with payment issues.

BTW, I have neither financial or any other interest in either of the server providers I recommended. Just trying to help out.

Let me know if this all works or not, and good luck with this bastard.