Buna kim dayanabilir!?

14-03-2009, 22:50:19

Herkese iyi akşamlar

Sitem yeni gelişmekte ve büyümekte olup gunluk tekil ve çoğul sayfa gösterimi kademeli olarak artmaktadır. Veritabanın da ki sessions tablosundan da 80 portundan anlık girişleri / çıkışları ip olarak ta takip edebiliyorum.

Fakat 5 gün önce birden bire ssh ile sunucuma ulaşamaz oldum, ram tavan yapıp sunucum tamamen yanıt vermez oldu.

reboot yapıyorum ve httpd yi çalıştırdıgımda ortalama 15 dk sonra tekrar sunucu ile iletişimim kesiliyor, ram tavan...

httpdyi kapatıyorum, normale donuyor..

Konuyu araştıRmaya başladığımda ilginç bişiler dikkatimi çekti;
ortalama anlık ziyaretçi sayısı 50 tekil kişi iken 10 dk içinde veritabanımdaki session tablomda 150 dan fazla kayıtlı alan (ip) görüyorum,fakat tekrarlanan ip değiller aksine birbirinden farklı ip adresleriler ve bu iplerin sitemin hitinin artmasında en ufak bir etkisi bile olmuyor

dedicated sunucum var
debian kullaniyorum
88.212.65.22 (sunucumun ipsi)

ve su anda httpdyi tamamen stopladım

RAM BILGILERIM ASAGIKDAKİ GİBİDİR,
Mem: 2067764k total, 651368k used, 1416396k free, 9324k buffers
Swap: 2650684k total, 0k used, 2650684k free, 215796k cached

apf
mod_security
mod_evasive (apf ile etkileşimli ayarladım)

bu 3 bileşeni sunucuma entegre etmeme rağmen, halen aşırı yoğun istekler yapılmaya devam edilmektedir(session tablomdan takip ediyorum).

netstat -an dedigimde

Alıntı

tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33731 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33732 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:22 ::ffff:88.247.106.:1251 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33733 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33734 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:85.100.65.6:3422 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33735 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:68.195.180:50644 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33736 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33737 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33738 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33739 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33740 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33741 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:22 ::ffff:88.247.106.:1258 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33742 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:85.108.215.:3584 FIN_WAIT2
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33743 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33744 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:78.169.59.1:4273 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33745 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33746 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:95.70.129.:57429 FIN_WAIT2
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33747 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33748 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33749 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33750 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33751 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33752 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33753 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33754 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33755 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33756 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33757 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33758 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37086 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33759 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37087 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37088 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33760 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37089 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:33761 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37090 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37091 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37092 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37093 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37094 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37095 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37096 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37097 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37098 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37099 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:82.138.49.:19776 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37100 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37101 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37102 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:85.101.125.:1030 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37103 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37104 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37105 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37106 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37107 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:66.249.71.:58712 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:85.110.50.8:2431 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37108 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:85.110.50.8:2424 FIN_WAIT2
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37109 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37110 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37111 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37112 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37113 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37114 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:62.192.151.:2243 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37115 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:62.192.151.:2242 ESTABLISHED
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37116 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37117 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37118 TIME_WAIT
tcp6 0 0 ::ffff:88.212.65.22:80 ::ffff:88.212.65.:37119 TIME_WAIT
udp 0 0 0.0.0.0:32768 0.0.0.0

udp 0 0 0.0.0.0:32771 0.0.0.0

udp 0 0 0.0.0.0:668 0.0.0.0

udp 0 0 88.212.65.22:53 0.0.0.0

udp 0 0 127.0.0.1:53 0.0.0.0

udp 0 0 0.0.0.0:111 0.0.0.0

udp6 0 0 :::32769 ::

udp6 0 0 :::53 ::

Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 5716 /var/run/acpid.socket
unix 2 [ ACC ] STREAM LISTENING 11240 /var/run/proftpd/proftpd.sock
unix 2 [ ACC ] STREAM LISTENING 11214 /tmp/mysql.sock
unix 2 [ ACC ] STREAM LISTENING 10708 /var/run/dovecot/dict-server
unix 2 [ ACC ] STREAM LISTENING 10710 /var/run/dovecot/login/default
unix 2 [ ACC ] STREAM LISTENING 10715 /var/run/dovecot/auth-worker.4917
unix 2 [ ACC ] STREAM LISTENING 9837 @/var/run/hald/dbus-dM7BkZWS1H
unix 2 [ ] DGRAM 3276 @/org/kernel/udev/udevd
unix 2 [ ] DGRAM 9845 @/org/freedesktop/hal/udev_event
unix 6 [ ] DGRAM 5529 /dev/log
unix 2 [ ACC ] STREAM LISTENING 9821 /var/run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 9836 @/var/run/hald/dbus-fFoId9yxVj
unix 2 [ ACC ] STREAM LISTENING 11200 /var/run/proftpd/proftpd.sock
unix 3 [ ] STREAM CONNECTED 179718
unix 3 [ ] STREAM CONNECTED 179717
unix 3 [ ] STREAM CONNECTED 179716
unix 3 [ ] STREAM CONNECTED 179715
unix 3 [ ] STREAM CONNECTED 177045
unix 3 [ ] STREAM CONNECTED 177044
unix 3 [ ] STREAM CONNECTED 177043
unix 3 [ ] STREAM CONNECTED 177042
unix 2 [ ] DGRAM 11471
unix 3 [ ] STREAM CONNECTED 10973 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10972
unix 3 [ ] STREAM CONNECTED 10969 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10968
unix 3 [ ] STREAM CONNECTED 10965 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10964
unix 3 [ ] STREAM CONNECTED 10961 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10959
unix 3 [ ] STREAM CONNECTED 10960 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10958
unix 3 [ ] STREAM CONNECTED 10953 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10950
unix 3 [ ] STREAM CONNECTED 10952 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10947
unix 3 [ ] STREAM CONNECTED 10951 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10946
unix 3 [ ] STREAM CONNECTED 10941 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10937
unix 3 [ ] STREAM CONNECTED 10940 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10936
unix 3 [ ] STREAM CONNECTED 10939 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10931
unix 3 [ ] STREAM CONNECTED 10938 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10930
unix 3 [ ] STREAM CONNECTED 10925 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10922
unix 3 [ ] STREAM CONNECTED 10924 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10921
unix 3 [ ] STREAM CONNECTED 10923 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10916
unix 3 [ ] STREAM CONNECTED 10913 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10910
unix 3 [ ] STREAM CONNECTED 10912 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10907
unix 3 [ ] STREAM CONNECTED 10911 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10904
unix 3 [ ] STREAM CONNECTED 10901 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10899
unix 3 [ ] STREAM CONNECTED 10900 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10898
unix 3 [ ] STREAM CONNECTED 10893 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10892
unix 3 [ ] STREAM CONNECTED 10889 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10887
unix 3 [ ] STREAM CONNECTED 10888 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10884
unix 3 [ ] STREAM CONNECTED 10881 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10879
unix 3 [ ] STREAM CONNECTED 10880 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10876
unix 3 [ ] STREAM CONNECTED 10873 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10871
unix 3 [ ] STREAM CONNECTED 10872 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10868
unix 3 [ ] STREAM CONNECTED 10865 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10863
unix 3 [ ] STREAM CONNECTED 10864 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10862
unix 3 [ ] STREAM CONNECTED 10857 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10854
unix 3 [ ] STREAM CONNECTED 10856 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10851
unix 3 [ ] STREAM CONNECTED 10855 /var/run/dovecot/login/default
unix 3 [ ] STREAM CONNECTED 10848
unix 3 [ ] STREAM CONNECTED 10841
unix 3 [ ] STREAM CONNECTED 10840
unix 3 [ ] STREAM CONNECTED 10838
unix 3 [ ] STREAM CONNECTED 10837
unix 3 [ ] STREAM CONNECTED 10835
unix 3 [ ] STREAM CONNECTED 10834
unix 3 [ ] STREAM CONNECTED 10832
unix 3 [ ] STREAM CONNECTED 10831
unix 3 [ ] STREAM CONNECTED 10829
unix 3 [ ] STREAM CONNECTED 10828
unix 3 [ ] STREAM CONNECTED 10826
unix 3 [ ] STREAM CONNECTED 10825
unix 3 [ ] STREAM CONNECTED 10823
unix 3 [ ] STREAM CONNECTED 10822
unix 3 [ ] STREAM CONNECTED 10820
unix 3 [ ] STREAM CONNECTED 10819
unix 3 [ ] STREAM CONNECTED 10817
unix 3 [ ] STREAM CONNECTED 10816
unix 3 [ ] STREAM CONNECTED 10814
unix 3 [ ] STREAM CONNECTED 10813
unix 3 [ ] STREAM CONNECTED 10811
unix 3 [ ] STREAM CONNECTED 10810
unix 3 [ ] STREAM CONNECTED 10808
unix 3 [ ] STREAM CONNECTED 10807
unix 3 [ ] STREAM CONNECTED 10805
unix 3 [ ] STREAM CONNECTED 10804
unix 3 [ ] STREAM CONNECTED 10802
unix 3 [ ] STREAM CONNECTED 10801
unix 3 [ ] STREAM CONNECTED 10799
unix 3 [ ] STREAM CONNECTED 10798
unix 3 [ ] STREAM CONNECTED 10796
unix 3 [ ] STREAM CONNECTED 10795
unix 3 [ ] STREAM CONNECTED 10793
unix 3 [ ] STREAM CONNECTED 10792
unix 3 [ ] STREAM CONNECTED 10790
unix 3 [ ] STREAM CONNECTED 10789
unix 3 [ ] STREAM CONNECTED 10787
unix 3 [ ] STREAM CONNECTED 10786
unix 3 [ ] STREAM CONNECTED 10784
unix 3 [ ] STREAM CONNECTED 10783
unix 3 [ ] STREAM CONNECTED 10781
unix 3 [ ] STREAM CONNECTED 10780
unix 3 [ ] STREAM CONNECTED 10778
unix 3 [ ] STREAM CONNECTED 10777
unix 3 [ ] STREAM CONNECTED 10775
unix 3 [ ] STREAM CONNECTED 10774
unix 3 [ ] STREAM CONNECTED 10772
unix 3 [ ] STREAM CONNECTED 10771
unix 3 [ ] STREAM CONNECTED 10769
unix 3 [ ] STREAM CONNECTED 10768
unix 3 [ ] STREAM CONNECTED 10766
unix 3 [ ] STREAM CONNECTED 10765
unix 3 [ ] STREAM CONNECTED 10763
unix 3 [ ] STREAM CONNECTED 10762
unix 3 [ ] STREAM CONNECTED 10760
unix 3 [ ] STREAM CONNECTED 10759
unix 3 [ ] STREAM CONNECTED 10757
unix 3 [ ] STREAM CONNECTED 10756
unix 3 [ ] STREAM CONNECTED 10754
unix 3 [ ] STREAM CONNECTED 10753
unix 3 [ ] STREAM CONNECTED 10751
unix 3 [ ] STREAM CONNECTED 10750
unix 3 [ ] STREAM CONNECTED 10748
unix 3 [ ] STREAM CONNECTED 10747
unix 3 [ ] STREAM CONNECTED 10713
unix 3 [ ] STREAM CONNECTED 10712
unix 2 [ ] DGRAM 10701
unix 3 [ ] STREAM CONNECTED 10674 /var/run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 10673
unix 3 [ ] STREAM CONNECTED 10471 /var/run/acpid.socket
unix 3 [ ] STREAM CONNECTED 10470
unix 3 [ ] STREAM CONNECTED 10463 @/var/run/hald/dbus-fFoId9yxVj
unix 3 [ ] STREAM CONNECTED 10444
unix 3 [ ] STREAM CONNECTED 9840 @/var/run/hald/dbus-dM7BkZWS1H
unix 3 [ ] STREAM CONNECTED 9839
unix 3 [ ] STREAM CONNECTED 9824
unix 3 [ ] STREAM CONNECTED 9823
unix 2 [ ] DGRAM 5559
unix 2 [ ] DGRAM 5544

çok ilginçtir kendi ipmi tekrarlı bi şekilde görüyorum, bu durum normalmidir?

ayrıca
netstat -an | grep :80 | sort | awk '{print $5}' dediğimde

Alıntı

::ffff:88.212.65.:52790
::ffff:88.212.65.:52791
::ffff:88.212.65.:52792
::ffff:88.212.65.:52793
::ffff:88.212.65.:52794
::ffff:88.212.65.:52795
::ffff:88.212.65.:52796
::ffff:88.212.65.:52797
::ffff:88.212.65.:52798
::ffff:88.212.65.:52799
::ffff:88.212.65.:52800
::ffff:88.212.65.:52801
::ffff:88.212.65.:52802
::ffff:88.212.65.:52803
::ffff:88.212.65.:52804
::ffff:88.212.65.:52805
::ffff:88.212.65.:52806
::ffff:88.212.65.:52807
::ffff:88.212.65.:52808
::ffff:88.212.65.:52809
::ffff:88.212.65.:52810
::ffff:88.212.65.:52811
::ffff:88.212.65.:52812
::ffff:88.212.65.:52813
::ffff:88.212.65.:52814
::ffff:88.212.65.:52815
::ffff:88.212.65.:52816
::ffff:88.212.65.:52817
::ffff:88.212.65.:52818
::ffff:88.212.65.:52819
::ffff:71.181.32.:63354
::ffff:72.30.81.1:60211
::ffff:78.166.220:51029
::ffff:78.179.240:49345
::ffff:78.179.240:49350
::ffff:78.179.84.1:2082
::ffff:84.162.127.:1301
::ffff:85.102.169.:1272
::ffff:85.107.43.9:2394
::ffff:85.234.152:51317
::ffff:85.98.110.1:1620
::ffff:88.228.246.:2086
::ffff:88.230.106:49317
::ffff:88.230.106:49328
::ffff:88.231.200.:1251
::ffff:88.231.200.:1258
::ffff:88.231.200.:1262
::ffff:88.234.120.:4879
::ffff:88.238.55.2:4336
::ffff:88.240.25.2:1971
::ffff:88.240.25.2:1972
::ffff:88.240.25.2:1973
::ffff:88.240.25.2:1974
::ffff:88.240.25.2:1977
::ffff:88.240.25.2:1979
::ffff:88.244.11.2:1554
::ffff:88.244.11.2:1582
::ffff:88.253.77.7:4162
::ffff:78.171.234.:4061
::ffff:88.247.109:50311
::ffff:88.247.109:50314
::ffff:66.249.71.:56409
::ffff:85.98.110.1:1636
::ffff:88.231.200.:1268
::ffff:212.174.248:4552
::ffff:88.244.11.2:1583
::ffff:88.233.166.:1485

bilgisini alıyorum

ayrıca apache error loglarında
[Sat Mar 14 17:31:24 2009] [error] [client 80.249.173.179] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind

şu uyarıyı sıklıkla görür oldum, nette araştırdır ama faydalı sonuçlara ulşamadım,nedir bu?

ben ne saldırısı yiyorum ?
çözüm ne önerirsiniz ?

15-03-2009, 00:12:14

#2

helperman

Allah yardımcın olsun kardeş valla herkes u illetten bıktı artık.

15-03-2009, 01:35:37

#3

~~mow~~

Üyeliği durduruldu

Web sunucun ile ilgili herhangi birşey yokmuş gibi gözüküyor. htaccess ile ilgili bir değişiklik yapmışmıydın?

Bununla beraber dovecot kullanmadığım için bilmiyorum ancak mailini aynı anda kontrol eden insan sayısı sanki biraz fazla gibi geldi bana, birileri webmail üzerinden şifre bulmaya çalışıyor olabilir, webmaili iptal edip kontrol etmende yarar var gibi.

Ayrıca, aldığın uyarı (w00tw00t.at.ISC.SANS.DFind) bir açık tarayıcıdır bu forumda aynı dertten muzdarip bir arkadaşa yol göstermiştim ona bir göz atabilirsin. Doğrudan ip adresini iptables ile engelleyebilirsin.

15-03-2009, 01:46:01

#4

~~mow~~

Üyeliği durduruldu

oops oradaki ipler ile senin sunucunun ipsi aynıymış, bu demek oluyorki eğer bir htaccess hatası yoksa ya da sürekli döngü içerisinde kendi kendine bağlanan bir script yoksa, ufak bir saldırı denemesi yapılıyor sunucuna. Engellemek için; "/etc/sysctl.conf" içerisine "net.ipv4.conf.all.rp_filter = 1" ekledikten sonra sırasıyla;

#sysctl -p
#iptables -A INPUT -i eth0 -s 88.212.65.22 -j DROP
#iptables -A OUTPUT -o eth0 -s 88.212.65.22 -j DROP

komutlarını aynen çalıştır. böylece en azından spoofing yaparlarken senin sunucunun ip adresini kullanamazlar.

15-03-2009, 10:16:04

#5

soulful

wow, net.ipv4.conf.all.rp_filter = 1 zaten tanımlamış durumdayım
dediğin iptables komutunua uyarladım ayrıca
loop eden bir scripte çalışmıyor, .htaccess te de bir problem yaratacak satırlar yer almıyor

buna rağmen aynı şeyleri goruyorum

şu w00w00t olayı canımı sıkmaya basladı

15-03-2009, 13:28:37

#6

~~akdeniz~~

Üyeliği durduruldu

vallah hocam başımızdaki en sıkıntılardan biride bu o kadar emek veriyoruz sitelerimize ama malesef .engele olamıyoruz

15-03-2009, 15:47:42

#7

~~mow~~

Üyeliği durduruldu

webmail, phpmyadmin ve benzeri bilinen ve ortak yerlerden ulaşılabilen scriptleri iptal et, bakalım tekrar oluyor mu.

#ls -al /var/spool/cron/

bunun çıktısını da verebilir misin? Eğer bilgileri özel mesajla gönderebilirsen akşam saatlerinde bakabilirim, ben de merak ettim açıkçası. (acaba bir apache kurtçuğu falan olabilirmi diye) %90 ihtimalle birisi sunucunda kurulu hazır scriptlerin birinde bir açık bulup kullanıyor ama sunucuyu görmeden ancak kahve falı tadında konuşabiliyorum.

15-03-2009, 20:33:27

#8

soulful

mow ,ls -al /var/spool/cron/ komutu verdiğimde aşağıdaki sonuçlar goruntulenmekte

total 20
drwxr-xr-x 5 root root 4096 Jul 16 2008 .
drwxr-xr-x 7 root root 4096 Oct 3 04:16 ..
drwxrwx--T 2 daemon daemon 4096 Jul 16 2008 atjobs
drwxrwx--T 2 daemon daemon 4096 Jan 2 2006 atspool
drwx-wx--T 2 root crontab 4096 Mar 15 02:54 crontabs

ayrıca;

w00tw00t.at.ISC.SANS.DFind bunun icin bir cozum oneriniz yokmudur ?

21-03-2009, 11:53:38

#9

blacksea61

ip ni kaldır iistersen saldıran arkadaş önleme göre daha kuvetli gelmesin