Discuss

discuss@lists.centos.org

34758 discussions

iptables: hitcount
by Helmut Drodofsky 11 Jun '12

11 Jun '12

Hello, up to CentOS 5.3 it was possible, to control new ip connections by "recent", "seconds" and "hitcount" -A INPUT -m state --state NEW -m recent --set -p tcp --dport 80 -A INPUT -m state --state NEW -m recent --update --seconds 60 --hitcount 1000 -p tcp --dport 80 -j LOG --log-prefix "FW DROP IP Flood: " -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 1000 -j DROP -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT so that - short time high new connections rate for the web server where accepted, but not over a longer time. E.g. CentOS 5.8 or CentOS 6.2 accept only -A INPUT -m state --state NEW -m recent --set -p tcp --dport 80 -A INPUT -m state --state NEW -m recent --update --seconds 1 --hitcount 15 -p tcp --dport 80 -j LOG --log-prefix "FW DROP IP Flood: " -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -m recent --update --seconds 1 --hitcount 15 -j DROP -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT So a complex web page with many small icons e.g. webmail pages initiate the log in line 2 and drop in line 3 . hitcount does not accept values of 25 or above: [root@server ~]# iptables -A INPUT -m state --state NEW -m recent --set -p tcp --dport 80 [root@server~]# iptables -A INPUT -m state --state NEW -m recent --update --seconds 1 --hitcount 25 -p tcp --dport 80 -j LOG --log-prefix "FW DROP IP Flood: " iptables: Unknown error 4294967295 what can i do to protect the web server? Is there any any configuration parameter to increase the values for hitcount? Best regards Helmut Drodofsky -- Viele Grüße Helmut Drodofsky Internet XS Service GmbH Heßbrühlstraße 15 70565 Stuttgart Geschäftsführung Dr.-Ing. Roswitha Hahn-Drodofsky HRB 21091 Stuttgart USt.ID: DE190582774 Tel. 0711 781941 0 Fax: 0711 781941 79 Mail: info(a)internet-xs.de www.internet-xs.de

2 1

system date using ntp client is drifting
by Kaushal Shriyan 11 Jun '12

11 Jun '12

Hi, I have a set of servers whose system time is drifting. I am running ntp client on CentOS 5.8. My config is here -> http://fpaste.org/s55U/ Anything i am missing? Regards, Kaushal

6 8

Re: [CentOS] Error dovecot restart
by Muhammad A. Fatahna 11 Jun '12

11 Jun '12

> man touch > man chmod > man chown file has ready, chmod use 755 and chown use vmail, this below : [root@mail ~]# ls -la /etc/dovecot* -rwxr-xr-x 1 vmail vmail 42989 Jun 11 17:08 /etc/dovecot.conf -rwxr-xr-x 1 vmail vmail 181 Jun 11 15:27 /etc/dovecot-sql.conf [root@mail ~]# [root@mail ~]# ls -la /var/log/dovecot.log -rwxr-xr-x 1 vmail vmail 1180 Jun 11 16:42 /var/log/dovecot.log [root@mail ~]# there is something wrong on my configuration -- http://mafatahna.web.id

2 1

Re: [CentOS] 75% - 80% Rebuild Complete
by Eugene Poole 10 Jun '12

10 Jun '12

OK, I'm about 90% sure that I've corrected the boot loader situation with RAID-1 and the second hard drive. I haven't tested the correction, but here's what I did: Examined the grub.conf file and noticed that hd0 uses (hd0,1), so what followed was grub grub> device (hd1) /dev/sdc grub> root (hd1,1) grub> setup (hd1) <after receiving the successful message> grub> quit I didn't rebuild the boot loader on /dev/sda because it is working (if it ain't broke don't fix it). My situation is that I'm using 4 - 1 TB hard drives and I used the following pattern: /dev/sda | /dev/sdc = First Raid -1 volume /dev/sdb | /dev/sdd = Second Raid-1 volume Thanks all for the suggestions and thoughts! Gene

8 8

Kickstart progress report?
by Lars Hecking 09 Jun '12

09 Jun '12

When I'm kickstarting a CentOS5 machine, there's a progress report that shows how many packages have been installed so far, how many left, how much time it has taken, how much longer to go, and estimate for the total install time. Under CentOS6, I only get a report about packages (completed: N of M). Is there any way to add the time information back on CentOS6? This is a text install, btw.

2 1

Need to get latest version of freetds for centos 6.2
by Kaplan, Andrew H. 09 Jun '12

09 Jun '12

Hello -- What repository, or other website, can I access in order to get the latest version of freetds? The version that comes with centos 6.2 is the 0.64 release, and it has a bug in it that is preventing me from running another application. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

5 9

resource efficient log scanning tools
by Nataraj 08 Jun '12

08 Jun '12

I'm looking for a logfile scanner that can search for regular expressions in logfiles and send immediate email notifications. I'd like to try to find something that doesn't use huge amounts of memory. I'm currently running fail2ban and used it to do some of this scanning, but I'm finding that it can suck up memory and CPU resources when there is a lot of logging going on. I am aware of swatch, but most people say that it is pretty resource intensive as well. I came across logsurfer in google search and was wondering if anyone has experience with it or what other good alternatives might exist. While fancy features are nice, I'm willing to forgo them for lower resource consumption. Thanks, Nataraj

2 2

yum problem with glibc
by Timothy Murphy 08 Jun '12

08 Jun '12

Is anyone getting a yum update problem with glibc and glibc-common? I'm getting the error message ------------------------------- Error: Protected multilib versions: glibc-2.12-1.47.el6_2.12.x86_64 != glibc-2.12-1.47.el6_2.9.i686 ** Found 3 pre-existing rpmdb problem(s), 'yum check' output follows: bash-4.1.2-9.el6_2.x86_64 is a duplicate with bash-4.1.2-8.el6.centos.x86_64 glibc-common-2.12-1.47.el6_2.12.x86_64 is a duplicate with glibc- common-2.12-1.47.el6_2.9.x86_64 glibc-common-2.12-1.47.el6_2.12.x86_64 has missing requires of glibc = ('0', '2.12', '1.47.el6_2.12') ------------------------------- I've tried "rpm --rebuilddb" but that did not seem to help. Any suggestions or advice gratefully received. -- Timothy Murphy e-mail: gayleard /at/ eircom.net tel: +353-86-2336090, +353-1-2842366 s-mail: School of Mathematics, Trinity College Dublin

6 16

printer problem
by m.roth＠5-cent.us 08 Jun '12

08 Jun '12

Anyone dealt with an Epson Stylus Photo 2200? Disconnected from my machine, it won't even print a self-test page.... mark

3 5

CentOS 6.2: suspending vim with ctrl-z and resuming with fg - stopped working
by Alexander Farber 08 Jun '12

08 Jun '12

Hello, pardon my chaotic question, but does anybody have an idea, why can't I suspend vim-enhanced-7.2.411-1.6.el6.x86_64 with a CTRL-Z, then execute few commands at my bash prompt and then get back to the vim session again with "fg"? It has stopped working at my CentOS 6.2 machine (I haven't noticed exactly when) but works fine with CentOS 5.x. I'm using PuTTY to login to both. The error message I get is: afarber@www:~> fg sudo vim test.pl ~ [1]+ Stopped sudo vim test.pl (and nothing comes up) Thank you Alex

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss