mirror July 2021

mirror@lists.centos.org

21 participants
19 discussions

Mirror server with EICAR test string as hostname
by HAHN, TOBIAS 02 Aug '21

02 Aug '21

Hello everybody, we currently have the following issue: one of the mirrors which is behind http://centos.mirrors.as250.net has the hostname set to the EICAR AntiVirus test string, and now every connection from our network to these mirrors triggers alerts. Is there any way to identify the person(s) rsponsible for the operation of the mirror and ask them if they could change this? Best Regards, Tobias [cid:image001.png@01D77704.F2A62BF0] Tobias Hahn IT-Security Expert GIAC certified Incident Handler (GCIH) & Forensic Analyst (GCFA) Deutsche Lufthansa AG Computer Emergency Response Team, FRA GIXSC Airportring, Lufthansa Aviation Center (LAC) D-60549 Frankfurt am Main Mobile: +49 151 589 22792 Email: tobias.hahn(a)dlh.de<mailto:tobias.hahn@dlh.de> Internet: http://www.lufthansagroup.com<http://www.lufthansagroup.com/> SMIME-Certificate available at https://lh.securemail.lhsystems.com/certportal/ Lufthansa Root-CA available at https://www.lufthansagroup.com/de/ext/public-key-infrastructure.html Sitz der Gesellschaft / Corporate Headquarters: Deutsche Lufthansa Aktiengesellschaft, Koeln, Registereintragung / Registration: Amtsgericht Koeln HR B 2168 Vorsitzender des Aufsichtsrats / Chairman of the Supervisory Board: Dr. Karl-Ludwig Kley Vorstand / Executive Board: Carsten Spohr (Vorsitzender / Chairman), Christina Foerster, Harry Hohmeister, Dr. Detlef Kayser, Dr. Michael Niggemann, Remco Steenbergen

3 4

Re-enable US mirror
by Denis Verbin 29 Jul '21

29 Jul '21

Hi, re-enable please mirror in the list. It is disappeared, looks like because it had broken nginx config which leads to wrong files structure. HTTP: http://mirror.ette.biz/centos/ HTTPS: https://mirror.ette.biz/centos/ RSYNC: mirror.ette.biz::CentOS Sync schedule: Every 4 hrs Bandwidth: 10Gbps Location: Washington DC / Northern Virginia, USA. Sponsor: ETTE.biz <https://ette.biz/> Sponsor URL: https://ettebiz.com/ IPv4 address to authorize: 38.105.93.109 IPv6 address to authorize: Email contact: den.verbin(a)gmail.com Mirroring AltArch: no

2 1

Weird traffic pattern spotted, is it just us?
by Alex Iribarren 12 Jul '21

12 Jul '21

Hi all, First of all, sorry if this is the wrong mailing list for this, feel free to point me to a more appropriate place. Some time ago, I was looking at the httpd logs of our mirror servers and I noticed a weird pattern: we seem to have an awful lot of suspicious-looking partial content requests for ISO images. In the past 24 hours, we've had 64k requests for 98 different ISOs coming from 508 different IPs. A single IP address has sent 3115 partial content requests for CentOS-7.0-1406-x86_64-DVD.iso, and then moved on to requesting CentOS-5.11-i386-bin-DVD-1of2.iso 2069 times (in the last 24 hours). Downloading the full file doesn't seem to be the goal of this traffic, in most cases the clients download fewer bytes than the total filesize. To test this, I disabled partial requests on the server side so the full file would be served regardless of how many bytes a client requested, and the clients would carry on sending requesting even though they had already downloaded the entire file multiple times. The requests seem to all have random-ish useragents, but all of them start with "Mozilla/5.0", so they're pretending to be web browsers. The web browsers I've tested don't issue HTTP 206 requests when downloading files, even big ones, and they would probably stop when they had the full file anyway. The vast majority of these strange requests, 95%, seem to come from Chinese IPs. We get requests all the time, but they seem to pick up around 3am CEST and they start to be less frequent by 5pm, which sort-of matches Chinese daytime. Globally, these requests don't seem to be doing any harm, they are less than 1.2% of the requests we got in the last 24 hours, but they don't look like legitimate traffic and I just can't figure out what the point of it would be. Are we being used for weird speedtests from China? Or is this a really lazy DDoS attack? Does anybody else see this kind of traffic? Try looking for `http_status=206 useragent="Mozilla *" uri_path="*.iso"` in your logs, I'm curious to see if this is common or not. Cheers, Alex

2 2

mirror.lstn.net wget HTTPS Certificate Error
by Jim Archon 08 Jul '21

08 Jul '21

Hello, https://mirror.lstn.net/ is returning HTTPS certificate errors with wget. Are you getting the same errors with wget from this mirror? There seem to be no errors with wget with the other HTTPS mirrors. Interestingly, Google Chrome is not showing any Certificate errors on https://mirror.lstn.net/. wget https://mirror.lstn.net/centos/8.4.2105/isos/x86_64/CentOS-8.4.2105-x86_64-… --2021-07-08 09:35:51-- https://mirror.lstn.net/centos/8.4.2105/isos/x86_64/CentOS-8.4.2105-x86_64-… Resolving mirror.lstn.net (mirror.lstn.net)... 2607:ff68:1:4c::100, 64.31.0.51 Connecting to mirror.lstn.net (mirror.lstn.net)|2607:ff68:1:4c::100|:443... connected. ERROR: The certificate of ‘mirror.lstn.net’ is not trusted. ERROR: The certificate of ‘mirror.lstn.net’ doesn't have a known issuer. ERROR: The certificate of ‘mirror.lstn.net’ has expired.

3 2

https://mirror.hkt.cc/ HTTPS Certificate Error
by Jim Archon 08 Jul '21

08 Jul '21

Hello, https://mirror.hkt.cc/ is returning HTTPS Certificate Error.

1 0

Adding OXAHOST CentOS Mirror
by Centos Oxahost 08 Jul '21

08 Jul '21

Greetings, On the behalf of Oxahost, I would like to announce that our server is ready to serve as a CentOS mirror. Following are the details : HTTP: [ https://mirror.centos.oxahost.tn/centos/ | https://mirror.centos.oxahost.tn/centos/ ] HTTPS: [ https://mirror.centos.oxahost.tn/centos/ | https://mirror.centos.oxahost.tn/centos/ ] RSYNC: rsync://mirror.centos.oxahost.tn/centos/ Sync schedule: Every 4 hrs Bandwidth: 100MB/s Location: Tunisia Sponsor: Oxahost Sponsor URL: oxahost.tn IPv4 address to authorize: 102.219.176.201 Email contact: centos(a)oxahost.com Mirroring AltArch: No Sincerely, Tarek from Oxahost.

2 2

Retire mirror schoemaker.systems
by Quentin Schoemaker 08 Jul '21

08 Jul '21

Hi, Please retire my mirror: mirror.schoemaker.systems it will not come back online anymore. Best regards, Quentin

2 1

new mirror server
by mirror＠crexio.com 08 Jul '21

08 Jul '21

Please add our mirror server in the repo. HTTP: http://mirror.crexio.com/centos/ HTTPS: https://mirror.crexio.com/centos/ RSYNC: rsync:// mirror.crexio.com/centos/ Sync schedule: Every 3 hrs Bandwidth: 1 Gbps Location: France Sponsor: CREXIO Sponsor URL: crexio.com IPv4 address to authorize: 195.154.184.133 IPv6 address to authorize: Email contact: mirror(a)crexio.com <mailto:mirror@crexio.com> Mirroring AltArch: no

3 3

Adding VelociHOST CentOS Mirror
by Roger Rivera 08 Jul '21

08 Jul '21

Hello, We are sponsoring a public CentOS mirror and woud like to submit our request to be included in the official mirror list with the following details. HTTP: http://mirror.mia.velocihost.net/centos/ HTTPS: https://mirror.mia.velocihost.net/centos/ Sync schedule: Every 6 hrs Bandwidth: 1000 Mbps Location: Miami, FL USA. Sponsor: VelociHOST Sponsor URL: https://www.velocihost.net/ IPv4 address to authorize: 192.171.19.138 IPv6 address to authorize: 2602:ff50:0:1:ec4:7aff:fe18:6172 Email contact: support(a)velocihost.net Mirroring AltArch: no Thank you, *Roger Rivera* English | Español *[image: Go to VelociHOST Website] <https://www.velocihost.net/?utm_source=email_signature&utm_medium=logo-image>* *________* Enterprise Cloud Hosting Solutions Miami and New York Data Centers *Phone*: (833) 835-6244 *Email*: roger(a)velocihost.net* | **Web*: www.velocihost.net <https://www.velocihost.net/?utm_source=email_signature&utm_medium=logo-image> [image: Like us on Facebook] <https://www.facebook.com/velocihostnet> [image: Follow us on Twitter] <https://twitter.com/VelociHOSTnet> [image: Call us on WhatsApp] <https://wa.me/18338356244>

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

mirror July 2021