<![CDATA[Messages posted by "blackwidow"]]> /hvaonline/posts/listByUser/46580.html JForum - http://www.jforum.net CPU tăng cao khi traffic tăng /hvaonline/posts/preList/45838/281744.html#281744 /hvaonline/posts/preList/45838/281744.html#281744 GMT Kết hợp Nginx + Varnish + Apache /hvaonline/posts/preList/45532/280319.html#280319 /hvaonline/posts/preList/45532/280319.html#280319 GMT Looking for tutorial writer

rs wrote:
50$, I will consider 
I can easily find outsource from India with that price range even lower. Since I'm Vietnamese I would rather help Vietnamese community rather foreigner community. Again this is for my personal web/blog, I want to keep my web/blog "alive", I do not have time to write and update it regularly. Thanks for your offer and have a nice day. :) ]]> /hvaonline/posts/preList/45508/280036.html#280036 /hvaonline/posts/preList/45508/280036.html#280036 GMT Looking for tutorial writer Requirement
  • 500 words or longer in English Linux/open source/networking/security topic related No grammar or spelling mistake Original writing, NO plagiarism
Payment term
  • $5 USD per article. Payment will be made via paypal transfer, or cash (saigon only). I reserve the right to reject any article that does not meet my expectation. Your article will belong to me, you have no right to that article after payment is being made.
I speak English and Vietnamese. You can reach me at tychuot at gmail dot com]]> /hvaonline/posts/preList/45508/280022.html#280022 /hvaonline/posts/preList/45508/280022.html#280022 GMT hỏi về offload database /hvaonline/posts/preList/45455/279766.html#279766 /hvaonline/posts/preList/45455/279766.html#279766 GMT Vấn đề với RAM máy tính /hvaonline/posts/preList/45088/278389.html#278389 /hvaonline/posts/preList/45088/278389.html#278389 GMT nhiều virtualhost trên chung 1 ip, cần giúp NameVirtualHost *:80 # # NOTE: NameVirtualHost cannot be used without a port specifier # (e.g. :80) if mod_ssl is being used, due to the nature of the # SSL protocol. # # # VirtualHost example: # Almost any Apache directive may go into a VirtualHost container. # The first VirtualHost section is used for requests without a known # server name. # #<VirtualHost *:80> # ServerAdmin webmaster@dummy-host.example.com # DocumentRoot /www/docs/dummy-host.example.com # ServerName dummy-host.example.com # ErrorLog logs/dummy-host.example.com-error_log # CustomLog logs/dummy-host.example.com-access_log common #</VirtualHost> mặc định bị comment out, mò mẫm 1 hồi, bỏ comment của cái này ra, mọi thứ chạy yên ổn, mất luôn cái warn _default_ VirtualHost overlap on port 80. còn khai báo virtualhost thì mình để là <VirtualHost *:80> cám ơn các bác giúp đỡ ^^]]> /hvaonline/posts/preList/44398/274145.html#274145 /hvaonline/posts/preList/44398/274145.html#274145 GMT nhiều virtualhost trên chung 1 ip, cần giúp /hvaonline/posts/preList/44398/274036.html#274036 /hvaonline/posts/preList/44398/274036.html#274036 GMT nhiều virtualhost trên chung 1 ip, cần giúp Code:
# abc.net virualhost #

<VirtualHost *:80>

    ServerAdmin root@localhost
    DocumentRoot /home/tiger/www/abc.net/
    ServerName www.abc.net
    ServerAlias www.abc.net
    ErrorLog logs/abc.net-error_log
    CustomLog logs/abc.net-access_log common

<Directory />
  Order Deny,Allow
  Deny from all
  Options None
  AllowOverride None
</Directory>
<Directory /home/tiger/www/abc.net/>
  Order Allow,Deny
  Allow from all
  Options -ExecCGI -FollowSymLinks -Indexes
  AllowOverride All
</Directory>

</VirtualHost>

# def.com virtualhost #

<VirtualHost *:80>

    ServerAdmin root@localhost
    DocumentRoot /home/tiger/www/def.com/
    ServerName www.def.com
    ServerAlias www.def.com www.def.net
    ErrorLog logs/def.com-error_log
    CustomLog logs/def.com-access_log common

<Directory />
  Order Deny,Allow
  Deny from all
  Options None
  AllowOverride None
</Directory>
<Directory /home/tiger/www/def.com/>
  Order Allow,Deny
  Allow from all
  Options -ExecCGI -FollowSymLinks -Indexes
  AllowOverride All
</Directory>

</VirtualHost>

# hyj.org virtualhost #

<VirtualHost *:80>

    ServerAdmin root@localhost
    DocumentRoot /home/tiger/www/hyj.org/
    ServerName www.hyj.org
    ServerAlias www.hyj.org
    ErrorLog logs/hyj.org-error_log
    CustomLog logs/hyj.org-access_log common

<Directory />
  Order Deny,Allow
  Deny from all
  Options None
  AllowOverride None
</Directory>
<Directory /home/tiger/www/hyj.org/>
  Order Allow,Deny
  Allow from all
  Options -ExecCGI -FollowSymLinks -Indexes
  AllowOverride All
</Directory>

</VirtualHost>
vẫn bị]]> /hvaonline/posts/preList/44398/274032.html#274032 /hvaonline/posts/preList/44398/274032.html#274032 GMT nhiều virtualhost trên chung 1 ip, cần giúp /hvaonline/posts/preList/44398/274030.html#274030 /hvaonline/posts/preList/44398/274030.html#274030 GMT nhiều virtualhost trên chung 1 ip, cần giúp /hvaonline/posts/preList/44398/274023.html#274023 /hvaonline/posts/preList/44398/274023.html#274023 GMT nhiều virtualhost trên chung 1 ip, cần giúp # abc.net virualhost # <VirtualHost abc.net:80> ServerAdmin root@localhost DocumentRoot /home/tiger/www/abc.net/ ServerName abc.net ServerAlias abc.net ErrorLog logs/abc.net-error_log CustomLog logs/abc.net-access_log common <Directory /> Order Deny,Allow Deny from all Options None AllowOverride None </Directory> <Directory /home/tiger/www/abc.net/> Order Allow,Deny Allow from all Options -ExecCGI -FollowSymLinks -Indexes AllowOverride All </Directory> </VirtualHost> # def.com virtualhost # <VirtualHost def.com:80> ServerAdmin root@localhost DocumentRoot /home/tiger/www/def.com/ ServerName def.com ServerAlias def.com def.net ErrorLog logs/def.com-error_log CustomLog logs/def.com-access_log common <Directory /> Order Deny,Allow Deny from all Options None AllowOverride None </Directory> <Directory /home/tiger/www/def.com/> Order Allow,Deny Allow from all Options -ExecCGI -FollowSymLinks -Indexes AllowOverride All </Directory> </VirtualHost>   cái này là httpd.conf của mình. mỗi lần restart httpd thì bị Starting httpd: [Mon Mar 11 23:58:57 2013] [warn] VirtualHost abc.net:80 overlaps with VirtualHost def.com:80, the first has precedence, perhaps you need a NameVirtualHost directive nó báo là một chuyện, mỗi lần vào def.com thì toàn bị trỏ vô trang chủ của abc.net :( còn đây là hosts file của mình
xxx.xxx.xxx.xxx abc.net abc def.com def.net 
mong các bác giúp -:|- ]]> /hvaonline/posts/preList/44398/274020.html#274020 /hvaonline/posts/preList/44398/274020.html#274020 GMT Active Webcam? (camera giám sát?) /hvaonline/posts/preList/44137/273474.html#273474 /hvaonline/posts/preList/44137/273474.html#273474 GMT Chạy ứng dụng Windows trên Ubuntu 12.10 64bit? /hvaonline/posts/preList/44047/272255.html#272255 /hvaonline/posts/preList/44047/272255.html#272255 GMT /dev/shm vs /tmp cho ssd /hvaonline/posts/preList/44049/272254.html#272254 /hvaonline/posts/preList/44049/272254.html#272254 GMT nat không vô được website /hvaonline/posts/preList/43654/270350.html#270350 /hvaonline/posts/preList/43654/270350.html#270350 GMT làm sao để tune up centos server? top - 22:27:42 up 8:40, 1 user, load average: 0.00, 0.00, 0.00 Tasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie Cpu(s): 0.0%us, 0.2%sy, 0.0%ni, 99.8%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 1012704k total, 373944k used, 638760k free, 29756k buffers Swap: 2064376k total, 0k used, 2064376k free, 201496k cached  đây là top trên vps
top - 09:28:14 up 26 min, 1 user, load average: 0.07, 0.04, 0.00 Tasks: 18 total, 1 running, 17 sleeping, 0 stopped, 0 zombie Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 131072k total, 39412k used, 91660k free, 0k buffers Swap: 655360k total, 24k used, 655336k free, 15932k cached 
108 tasks vs 18 tasks.... wtf mình đâu có cài/chạy gì nhiều trên cái server đó? mình fresh install bằng dĩa centos server]]> /hvaonline/posts/preList/43535/269890.html#269890 /hvaonline/posts/preList/43535/269890.html#269890 GMT sao iptable không block được ip ? /hvaonline/posts/preList/43310/269887.html#269887 /hvaonline/posts/preList/43310/269887.html#269887 GMT sao iptable không block được ip ?

tga wrote:
sao em mới cho
iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP  
thì tất cả các cổng đều bị đóng hết :( lại phải stop iptables mới vào lại đc :( 
vì bạn drop hết rồi, mặc định là ACCEPT, nếu bạn DROP hết như vậy thì bạn phải mở từng port riêng mà bạn cần xài. bạn xem lại cái iptables & script hoàn chỉnh mình chạy trên server của mình ở trên, post 4-5 gì đó. # allow server tcp ports 22,80,443,10000 iptables -A INPUT -p tcp -m multiport -m state -i eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 22,80,443,10000 iptables -A OUTPUT -p tcp -m multiport -m state -o eth0 --state ESTABLISHED -j ACCEPT --sports 22,80,443,10000 ]]> /hvaonline/posts/preList/43310/269685.html#269685 /hvaonline/posts/preList/43310/269685.html#269685 GMT sao iptable không block được ip ? /hvaonline/posts/preList/43310/269652.html#269652 /hvaonline/posts/preList/43310/269652.html#269652 GMT sao iptable không block được ip ? /hvaonline/posts/preList/43310/269394.html#269394 /hvaonline/posts/preList/43310/269394.html#269394 GMT sao iptable không block được ip ? /hvaonline/posts/preList/43310/269353.html#269353 /hvaonline/posts/preList/43310/269353.html#269353 GMT Lướt web trên centos /hvaonline/posts/preList/43387/269344.html#269344 /hvaonline/posts/preList/43387/269344.html#269344 GMT Lướt web trên centos /hvaonline/posts/preList/43387/269323.html#269323 /hvaonline/posts/preList/43387/269323.html#269323 GMT sao iptable không block được ip ? # Generated by iptables-save v1.4.7 on Tue Sep 11 20:38:31 2012 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :LOGNDROP - [0:0] -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOGNDROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j LOGNDROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOGNDROP -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOGNDROP -A INPUT -f -j LOGNDROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOGNDROP -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOGNDROP -A INPUT -m state --state INVALID -j LOGNDROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 4 --rttl --name SSH --rsource -j LOGNDROP -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -m limit --limit 25/min --limit-burst 100 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 50/sec --limit-burst 50 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443,10000 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p udp -m udp -m multiport --sports 123,53 -j ACCEPT -A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j LOGNDROP -A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOGNDROP -A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOGNDROP -A OUTPUT -f -j LOGNDROP -A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOGNDROP -A OUTPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOGNDROP -A OUTPUT -m state --state INVALID -j LOGNDROP -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOGNDROP -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443,10000 -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 123,53 -j ACCEPT -A LOGNDROP -j LOG --log-prefix "LOGNDROP: " -A LOGNDROP -j DROP COMMIT # Completed on Tue Sep 11 20:38:31 2012 # Generated by iptables-save v1.4.7 on Tue Sep 11 20:38:31 2012 *mangle :PREROUTING ACCEPT [1451511:74777798] :INPUT ACCEPT [1451511:74777798] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [372157:1486000721] :POSTROUTING ACCEPT [371275:1485305799] COMMIT # Completed on Tue Sep 11 20:38:31 2012 # Generated by iptables-save v1.4.7 on Tue Sep 11 20:38:31 2012 *nat :PREROUTING ACCEPT [3416:155332] :POSTROUTING ACCEPT [673:44245] :OUTPUT ACCEPT [804:54731] COMMIT # Completed on Tue Sep 11 20:38:31 2012  còn đây là script mình chạy
#!/bin/bash # ############################# # FIREWALL 1.0 # 09/11/2012 # # How to make the script executable # chmod +x firewall # # edit our script and run it from the shell with the following command # ./firewall ############################# ############################# # Flush all current rules from iptables iptables -F ############################# ############################# # Set default policies for INPUT, FORWARD and OUTPUT chains iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP ############################# ############################# # LOGDROPPER iptables -N LOGNDROP > /dev/null 2> /dev/null iptables -F LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "LOGNDROP: " iptables -A LOGNDROP -j DROP ############################# ############################# # force syn packets check, make sure new incoming tcp connections are syn packets; otherwise we need to drop them iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOGNDROP ############################# ############################# # drop invalid syn packets iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOGNDROP iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGNDROP iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOGNDROP ############################# ############################# # drop packets with incoming fragments. this attack result into linux server panic such data loss iptables -A INPUT -f -j LOGNDROP iptables -A OUTPUT -f -j LOGNDROP ############################# ############################# # xmas packets iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j LOGNDROP ############################# ############################# # drop all null packets iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j LOGNDROP ############################# ############################# # drop invalid iptables -A INPUT -m state --state INVALID -j LOGNDROP iptables -A OUTPUT -m state --state INVALID -j LOGNDROP ############################# ############################# # disable outgoign icmp request iptables -A OUTPUT -p icmp --icmp-type echo-request -j LOGNDROP ############################# ############################# # prevent ssh attacks iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 4 --rttl --name SSH -j LOGNDROP ############################# ############################# # Limit NEW traffic on port 80 iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 25/minute --limit-burst 100 -j ACCEPT ############################# ############################# # Limit established traffic iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT ############################# ############################# # allow loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT ############################# ############################# # allow server tcp ports 22,80,443,10000 iptables -A INPUT -p tcp -m multiport -m state -i eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 22,80,443,10000 iptables -A OUTPUT -p tcp -m multiport -m state -o eth0 --state ESTABLISHED -j ACCEPT --sports 22,80,443,10000 ############################# ############################# # allow tcp ports 80,443 for yum update iptables -A INPUT -p tcp -m tcp -m multiport -m state -i eth0 --state ESTABLISHED -j ACCEPT --sports 80,443 iptables -A OUTPUT -p tcp -m tcp -m multiport -m state -o eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 80,443 ############################# ############################# # allow udp ports 123 ntp (network time protocol), 53 dns (domain name service) iptables -A INPUT -p udp -m udp -m multiport -i eth0 -j ACCEPT --sports 123,53 iptables -A OUTPUT -p udp -m udp -m multiport -o eth0 -j ACCEPT --dports 123,53 ############################# ############################# # Save settings /sbin/service iptables save ############################# ############################# # List rules iptables -L -v #############################  
các bác thấy có gì mình còn sai xót thì xin góp ý, trong vài ngày tới mình sẽ cố gắng mở thêm mấy cái port để chạy traceroute & ping = php, vì sau khi xài iptables mấy cái ping, whois, traceroute php script chưa chạy được vì chưa có thời gian ngâm cứu.]]> /hvaonline/posts/preList/43310/269313.html#269313 /hvaonline/posts/preList/43310/269313.html#269313 GMT sao iptable không block được ip ? /hvaonline/posts/preList/43310/269306.html#269306 /hvaonline/posts/preList/43310/269306.html#269306 GMT Mua laptop đi học /hvaonline/posts/preList/43340/269252.html#269252 /hvaonline/posts/preList/43340/269252.html#269252 GMT sao iptable không block được ip ? # Generated by iptables-save v1.4.7 on Sat Sep 8 19:26:10 2012 *nat :PREROUTING ACCEPT [5:268] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [6:1068] COMMIT # Completed on Sat Sep 8 19:26:10 2012 # Generated by iptables-save v1.4.7 on Sat Sep 8 19:26:10 2012 *mangle :PREROUTING ACCEPT [380:23298] :INPUT ACCEPT [380:23298] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [274:48089] :POSTROUTING ACCEPT [268:47021] COMMIT # Completed on Sat Sep 8 19:26:10 2012 # Generated by iptables-save v1.4.7 on Sat Sep 8 19:26:10 2012 *filter :FORWARD DROP [0:0] :INPUT DROP [0:0] :OUTPUT DROP [0:0] -A INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 --state NEW --set --name SSH --rsource -A INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 --state NEW -j DROP --update --seconds 300 --hitcount 4 --rttl --name SSH --rsource -A INPUT -p tcp -m tcp -m connlimit --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with tcp-reset --connlimit-above 4 --connlimit-mask 32 -A INPUT -p tcp -m multiport -m state -i eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 22,80,443,10000 -A INPUT -p tcp -m tcp -m multiport -m state -i eth0 --state ESTABLISHED -j ACCEPT --sports 80,443 -A INPUT -p udp -m udp -m multiport -i eth0 -j ACCEPT --sports 123,53 -A OUTPUT -p tcp -m multiport -m state -o eth0 --state ESTABLISHED -j ACCEPT --sports 22,80,443,10000 -A OUTPUT -p tcp -m tcp -m multiport -m state -o eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 80,443 -A OUTPUT -p udp -m udp -m multiport -o eth0 -j ACCEPT --dports 123,53 COMMIT # Completed on Sat Sep 8 19:26:10 2012  nhưng vẫn bị nhè nhẹ
Sep 9 08:58:25 xxxxxxxxx sshd[20141]: Address 64.34.179.206 maps to server1.aclutx.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 08:58:25 xxxxxxxxx sshd[20141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.34.179.206 user=root Sep 9 08:58:27 xxxxxxxxx sshd[20141]: Failed password for root from 64.34.179.206 port 35164 ssh2 Sep 9 08:58:27 xxxxxxxxx sshd[20142]: Received disconnect from 64.34.179.206: 11: Bye Bye Sep 9 08:58:28 xxxxxxxxx sshd[20143]: Address 64.34.179.206 maps to server1.aclutx.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 08:58:28 xxxxxxxxx sshd[20143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.34.179.206 user=root Sep 9 08:58:28 xxxxxxxxx sshd[20145]: Address 64.34.179.206 maps to server1.aclutx.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 08:58:28 xxxxxxxxx sshd[20145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.34.179.206 user=root Sep 9 08:58:30 xxxxxxxxx sshd[20143]: Failed password for root from 64.34.179.206 port 39604 ssh2 Sep 9 08:58:30 xxxxxxxxx sshd[20144]: Received disconnect from 64.34.179.206: 11: Bye Bye Sep 9 08:58:30 xxxxxxxxx sshd[20145]: Failed password for root from 64.34.179.206 port 35938 ssh2 Sep 9 08:58:31 xxxxxxxxx sshd[20146]: Received disconnect from 64.34.179.206: 11: Bye Bye Sep 9 11:02:43 xxxxxxxxx sshd[21616]: Address 173.231.12.116 maps to 173-231-12-116.hosted.static.webnx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 11:02:43 xxxxxxxxx sshd[21616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.231.12.116 user=root Sep 9 11:02:45 xxxxxxxxx sshd[21616]: Failed password for root from 173.231.12.116 port 54261 ssh2 Sep 9 11:02:45 xxxxxxxxx sshd[21617]: Received disconnect from 173.231.12.116: 11: Bye Bye Sep 9 11:02:46 xxxxxxxxx sshd[21618]: Address 173.231.12.116 maps to 173-231-12-116.hosted.static.webnx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 11:02:46 xxxxxxxxx sshd[21618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.231.12.116 user=root Sep 9 11:02:46 xxxxxxxxx sshd[21620]: Address 173.231.12.116 maps to 173-231-12-116.hosted.static.webnx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 11:02:46 xxxxxxxxx sshd[21620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.231.12.116 user=root Sep 9 11:02:47 xxxxxxxxx sshd[21618]: Failed password for root from 173.231.12.116 port 60095 ssh2 Sep 9 11:02:47 xxxxxxxxx sshd[21619]: Received disconnect from 173.231.12.116: 11: Bye Bye Sep 9 11:02:48 xxxxxxxxx sshd[21620]: Failed password for root from 173.231.12.116 port 54863 ssh2 Sep 9 11:02:48 xxxxxxxxx sshd[21621]: Received disconnect from 173.231.12.116: 11: Bye Bye 
nhưng có vẻ 2 dòng iptables trên không xi nhê, vd như thằng 64.34.179.206, lúc 08:58:27 có 12 lần login = root, nhưng iptables luật là 4 lần 5 phút. Mình coi trong ssh server config của mình chỉ limit 6 lần login không thành công. Mình thử login bình thường với password sai liên tục thì được đúng 6 lần của ssh config, như vậy thì iptables không hoạt động đúng. Mình thắc mắc là tại sao brute force được nhiều như vậy trong thời gian ngắn trong khi ssh config chỉ cho 6?]]> /hvaonline/posts/preList/43310/269251.html#269251 /hvaonline/posts/preList/43310/269251.html#269251 GMT sao iptable không block được ip ? # Generated by iptables-save v1.4.7 on Thu Sep 6 17:13:16 2012 *nat :PREROUTING ACCEPT [7:518] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [6:2386] COMMIT # Completed on Thu Sep 6 17:13:16 2012 # Generated by iptables-save v1.4.7 on Thu Sep 6 17:13:16 2012 *mangle :PREROUTING ACCEPT [284:17857] :INPUT ACCEPT [284:17857] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [194:45919] :POSTROUTING ACCEPT [181:39025] COMMIT # Completed on Thu Sep 6 17:13:16 2012 # Generated by iptables-save v1.4.7 on Thu Sep 6 17:13:16 2012 *filter :FORWARD DROP [0:0] :INPUT DROP [0:0] :OUTPUT DROP [0:0] -A INPUT -s 61.0.0.0/8 -j DROP -A INPUT -s 69.0.0.0/8 -j DROP -A INPUT -s 84.0.0.0/8 -j DROP -A INPUT -s 93.0.0.0/8 -j DROP -A INPUT -s 111.0.0.0/8 -j DROP -A INPUT -s 115.0.0.0/8 -j DROP -A INPUT -s 116.0.0.0/8 -j DROP -A INPUT -s 117.0.0.0/8 -j DROP -A INPUT -s 118.0.0.0/8 -j DROP -A INPUT -s 119.0.0.0/8 -j DROP -A INPUT -s 120.0.0.0/8 -j DROP -A INPUT -s 121.0.0.0/8 -j DROP -A INPUT -s 122.0.0.0/8 -j DROP -A INPUT -s 123.0.0.0/8 -j DROP -A INPUT -s 124.0.0.0/8 -j DROP -A INPUT -s 125.0.0.0/8 -j DROP -A INPUT -s 126.0.0.0/8 -j DROP -A INPUT -s 169.0.0.0/8 -j DROP -A INPUT -s 195.0.0.0/8 -j DROP -A INPUT -s 200.0.0.0/8 -j DROP -A INPUT -s 202.0.0.0/8 -j DROP -A INPUT -s 203.0.0.0/8 -j DROP -A INPUT -s 210.0.0.0/8 -j DROP -A INPUT -s 211.0.0.0/8 -j DROP -A INPUT -s 218.0.0.0/8 -j DROP -A INPUT -s 219.0.0.0/8 -j DROP -A INPUT -s 220.0.0.0/8 -j DROP -A INPUT -s 221.0.0.0/8 -j DROP -A INPUT -s 222.0.0.0/8 -j DROP -A INPUT -p tcp -m tcp -m connlimit --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with tcp-reset --connlimi$ -A INPUT -p tcp -m multiport -m state -i eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 22,80,443,10000 -A INPUT -p tcp -m tcp -m multiport -m state -i eth0 --state ESTABLISHED -j ACCEPT --sports 80,443 -A INPUT -p udp -m udp -i eth0 --sport 53 -j ACCEPT -A INPUT -p udp -m udp --sport 123 -j ACCEPT -A OUTPUT -p tcp -m multiport -m state -o eth0 --state ESTABLISHED -j ACCEPT --sports 22,80,443,10000 -A OUTPUT -p tcp -m tcp -m multiport -m state -o eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 80,443 -A OUTPUT -p udp -m udp -o eth0 --dport 53 -j ACCEPT -A OUTPUT -p udp -m udp --dport 123 -j ACCEPT COMMIT # Completed on Thu Sep 6 17:13:16 2012  mọi thứ hoạt động tốt, nguyên ngày nay dừng được brute force ssh từ china vô server của mình. mình muốn hỏi cái này. làm sao để dời các dòng theo thứ tự mình muốn ? mình xài nano để edit xong rồi service iptables save, save xong thì thứ tự vẫn như trước khi save. Và, mình chưa hiểu lắm về cách sắp sếp thứ tự trong iptables, cái nào quan trọng hơn cái nào? cái nào cần đi trước? cái nào đi sau? ah còn cái nữa, khi dùng iptables trên, mấy cái traceroute, whois, ping php script của mình hết xài được :( permission not allowed hay socket error gì đó. làm sao để giải quyết được vấn đề này?]]> /hvaonline/posts/preList/43310/269119.html#269119 /hvaonline/posts/preList/43310/269119.html#269119 GMT cài soft cho distro Linux boot trực tiếp trên cd không qua hdd /hvaonline/posts/preList/43304/269019.html#269019 /hvaonline/posts/preList/43304/269019.html#269019 GMT