Search Results

Search found 350 results on 14 pages for 'intrusion prevention'.

Page 4/14 | < Previous Page | 1 2 3 4 5 6 7 8 9 10 11 12  | Next Page >

• How to set up a SPF record?

  - by MeltingDog

  The clients on my VPS are all getting spammed. The spam seemingly comes from their own email addresses - it is clear that somehow something got into my VPS and was able to capture all the email addresses that existed and is now using them to send spam. I was advised to set up a SPF record, but I am unsure what this is or how to go about it. After reading, I have figured out how to create one in CPanel, but I cannot find what to do with it now. Do I copy it into somewhere in my DNS records in Zone Management? Can anyone point me in the right direction?

  Read the article

• I'm using a shared server, and as such Gmail marks my email as spam (all from headers are different from the same IP)

  - by chipperyman573

  I have a shared server, meaning many people share the same IP. When I send an email, the @website.com is different from someone else that shares the same IP with me, therefore Gmail marks it as spam. For example: My website's IP is 1.2.3.4. My website is mywebsite.com Person 2's website's IP is hosted by the same host, and as such their IP is 1.2.3.4 Person 2's website is person2.com. When they send an email, it gets sent from [email protected] When I send an email, it gets sent from [email protected] According to Gmail's spam thing: "Use the same address in the 'From:' header on every bulk mail you send." Again, the only similarities between our websites is the IP. However, this causes Gmail to mark both our mail as spam. Is there a way to sort this out with Gmail?

  Read the article

• Why does Google mark one e-mail as spam while does not the other?

  - by nKn

  I've a Postfix installation which works fine, I don't get any trouble with mails sent through a mail client (in my case, Thunderbird or RoundCube) when the To: address is a GMail account. However, I recently needed to use the PHPMailer tool to send some e-mails to some GMail accounts, so I configured an account to be used via SASL authentication + TLS. I don't mean mass mailing, just 2-3 mails. If I send the e-mail from the Thunderbird or RoundCube clients, the mail is not marked as spam. However, if I use PHPMailer, it always gets catalogued as spam. So I compared both headers and I just can't find the reason why the second is marked as spam while the first one is just ok. The first header sent from a mail client which is not marked as spam: Delivered-To: [email protected] Received: by 10.76.153.102 with SMTP id vf6csp230573oab; Tue, 19 Aug 2014 11:08:19 -0700 (PDT) X-Received: by 10.60.23.39 with SMTP id j7mr45544050oef.20.1408471699715; Tue, 19 Aug 2014 11:08:19 -0700 (PDT) Return-Path: <[email protected]> Received: from mail.mydomain.com (X.ip-92-222-X.eu. [92.222.X.X]) by mx.google.com with ESMTPS id t5si27115082oej.10.2014.08.19.11.08.18 for <[email protected]> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 19 Aug 2014 11:08:19 -0700 (PDT) Received-SPF: pass (google.com: domain of [email protected] designates 92.222.X.X as permitted sender) client-ip=92.222.X.X; Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 92.222.X.X as permitted sender) [email protected]; dkim=pass (test mode) [email protected] Received: by mail.mydomain.com (Postfix, from userid 111) id D8F69120293D; Tue, 19 Aug 2014 19:08:17 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com; s=mail; t=1408471697; bh=wKMX9gkQ7tCLv8ezrG5t4bICm/SSLQsNfTdZMToksWw=; h=Date:From:To:Subject:From; b=qRNcYVdmk+n3D1uuv0FInTx7/LzH2ojck9DgCmabFPvfke233lkojUOjezCUGx7iV DL8EayZ28mzzzHpB7ETeMzop/5OS3BmvFtGKVD9gzc78cDIFXTDoRFAnkRWDR2IOxI SOn5tiyODTFpkbDgJOndzQ6qL5K0S9ASNGCZrNL4= X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on vpsX.ovh.net X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=ALL_TRUSTED,T_DKIM_INVALID autolearn=ham autolearn_force=no version=3.4.0 Received: from [192.168.1.111] (unknown [77.231.X.X]) (using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: [email protected]) by mail.mydomain.com (Postfix) with ESMTPSA id 910341202624 for <[email protected]>; Tue, 19 Aug 2014 19:08:17 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com; s=mail; t=1408471697; bh=wKMX9gkQ7tCLv8ezrG5t4bICm/SSLQsNfTdZMToksWw=; h=Date:From:To:Subject:From; b=qRNcYVdmk+n3D1uuv0FInTx7/LzH2ojck9DgCmabFPvfke233lkojUOjezCUGx7iV DL8EayZ28mzzzHpB7ETeMzop/5OS3BmvFtGKVD9gzc78cDIFXTDoRFAnkRWDR2IOxI SOn5tiyODTFpkbDgJOndzQ6qL5K0S9ASNGCZrNL4= Message-ID: <[email protected]> Date: Tue, 19 Aug 2014 19:08:24 +0100 From: My Name <[email protected]> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: My other account <[email protected]> Subject: . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit . The second header sent from PHPMailer which is always marked as spam: Delivered-To: [email protected] Received: by 10.76.153.102 with SMTP id vf6csp230832oab; Tue, 19 Aug 2014 11:12:10 -0700 (PDT) X-Received: by 10.60.121.67 with SMTP id li3mr44086252oeb.17.1408471930520; Tue, 19 Aug 2014 11:12:10 -0700 (PDT) Return-Path: <[email protected]> Received: from mail.mydomain.com (X.ip-92-222-X.eu. [92.222.X.X]) by mx.google.com with ESMTPS id w8si27103806obn.30.2014.08.19.11.12.10 for <[email protected]> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 19 Aug 2014 11:12:10 -0700 (PDT) Received-SPF: pass (google.com: domain of [email protected] designates 92.222.X.X as permitted sender) client-ip=92.222.X.X; Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 92.222.X.X as permitted sender) [email protected]; dkim=pass (test mode) [email protected] Received: by mail.mydomain.com (Postfix, from userid 111) id 1999D120293D; Tue, 19 Aug 2014 19:12:09 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com; s=mail; t=1408471929; bh=N1JuHq1S+8GrjHcEK3xn8P1JS+ygEBv5LKe0BiXuVJo=; h=Date:To:From:Reply-to:Subject:From; b=K7tcPyArzSTY91VEw6mAAFtDurSGwgTLGkfUZdC5mqsg0g/1LzmZkgwdjj4NdJa6M E2kDz3dwYN8FcZmbampJYFXxj4NQVtSnzjiWV40rpfOFqD2rXDGNIyB2QOjBZZ4WK3 7s4lyoJ/BrdQH4en8ctLVsDHed/KpHD4iGFEl67E= X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on vpsX.ovh.net X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=ALL_TRUSTED,T_DKIM_INVALID autolearn=ham autolearn_force=no version=3.4.0 Received: from rpi.mydomain.com (unknown [77.231.X.X]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: [email protected]) by mail.mydomain.com (Postfix) with ESMTPSA id B42AF1202624 for <[email protected]>; Tue, 19 Aug 2014 19:12:08 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com; s=mail; t=1408471928; bh=N1JuHq1S+8GrjHcEK3xn8P1JS+ygEBv5LKe0BiXuVJo=; h=Date:To:From:Reply-to:Subject:From; b=iXPM0tS36swudPTT4FOHHtPi5Ll6LbR60kNqCinZ8utcWoFE31SFTpoMEq5aCM5ux wQMdFiN8c6vkjRGabmvqFTTIbwJsrToHo/4+Lt5HEBoQQE2Y3T+xGmnmGAHCS6stKB yb7SVmtrIAsVtSMKA8VYIbmu2oYqV3afYt7g0OMQ= Date: Tue, 19 Aug 2014 20:12:07 +0200 To: [email protected] From: Trying another account <[email protected]> Reply-to: Trying another account <[email protected]> Subject: . Message-ID: <[email protected]> X-Priority: 3 X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net) MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" . I also tried: Adding a User-Agent header to match the first one. Removing the X-Mailer header. No one of them made a difference. Is there some significant difference which is making the second e-mail to be marked as spam by Google?

  Read the article

• How to get rid of spam that sends from clients own email address?

  - by MeltingDog

  I've Googled everywhere for a solution for this, but though the same issue appears to be happening to a lot of people, I havent found anything that helped. Several of my clients are receiving loads of spam emails with the senders email being their own. The emails subject line is: Environmental corporation searching for representatives worldwide. The emails are not being sent from any scripts in the sites and all the code appears clean. I have also updated the sites CMS. Would anyone know how to get round this issue? Any help is appreciated!

  Read the article

• Admin form that generates an email confirmation ends up in SPAM [duplicate]

  - by PJD Creative

  This question already has an answer here: How can I prevent my mail from being classified as spam? 10 answers I have an admin form that I have setup for a client, that generates an email confirmation from a template I have designer... It works really well but it ends up in spam some of the time, and this is real frustrating as it is just confirming some details for the customer of what they have just booked, not at all spam, and is accessed via a page where the admin requires login. Any suggestions as to why this may end up in spam. It does have dollar signs ($$) as it is confirming a price, im assuming this is one problem, the rest of it is just general dates and info about the confirmation. Is there any suggestions on how to get this out of spam? thanks in advance

  Read the article

• How do i fight spam against my mail servers ?

  - by tawfekov

  Hello , the problem I am having is the ability to fight spammers who add unsubscribe form this mail list by clicking here into their spam emails , turns out i am not the only suffer form this , gmail don't filter these mail as well . i made a simple test case , created an email on gmail and contacted one the spammer asking him to add my address to his list such a bad idea :P and google thought that i am already subscribed to that list and put it in my inbox . these kind of spammer uses many accounts to send their spam which make this job much harder how do i report those spammer , and block them in gmail or mail mail servers ?? what is the fastest way to do that ???

  Read the article

• How to prevent forum spam [closed]

  - by whamsicore

  Possible Duplicate: Make your site anti-bot? I want to prevent spam from overrunning my website, but neither do I want to make the user type in captcha each time they make a post. Any suggestions? Context: My website allows anonymous users to make leave comments on the fly. Comments are randomly displayed, so the more spam = higher chance of it being shown. Need to prevent spam but don't want to have each comment require captcha input.

  Read the article

• phpBB3 antispam: mod for "patrolling" the forum?

  - by STATUS_ACCESS_DENIED

  I've been working on various antispam measure in a phpBB3-based forum I host. Now I was thinking of an extension/mod that ties in with editing of posts (and later perhaps signatures/profiles) in that new text or edited text defaults to something like "not patrolled" and moderators could then in a special queue review text that contains links or similar item (based on heuristics). Now the question: does such a mod exist (I didn't find one)? If it does exist and anyone has used it (or them), please include your experiences with it in the answer.

  Read the article

• How can I reduce the number of spammers registering with my phpBB site?

  - by Jayapal Chandran

  I have a site which runs phpBB, on this site I have enabled user authentication through email when registering enabled captcha However I still get spam users every 20 to 30 minutes. Is there anything I can do to prevent this with the ucp.php file? I have already loaded a large list of IP addresses yet there are spam users registering all the time. One thing I can do is I can check the bounce mail to find the username and can pipe bounced mails to a php script and immediately delete that user, but I have not got any bounce back from hotmail or some other email clients. So this way it will catch hold of a certain percent of spam users but there are still a huge amount of users spamming. What else can I do to prevent spammers abusing my phpBB site?

  Read the article

• Silverstripe: How can I disable comments?

  - by SamIAm

  My client site is built in Silverstripe, there is a news page, and it allows people to leave comments. Unfortunately we've got loads of spam emails. I'm new to this, is there any way we can disable the comment field by default? How do I do it? Alternatively is there easy way for me to install a spam protection? Update - Because this is someone else's code, I just realised that they have some sort of spam protection already, so we are trying to disable comments now. I have manage to set no comment as default by changing file BlogEntry.php static $defaults = array( "ProvideComments" => true, 'ShowInMenus' => false ); to static $defaults = array( "ProvideComments" => false, //changed 'ShowInMenus' => false ); Am I on the right track to disable comments by default? Also how can I stop on the news page showing xxx comments link? eg Test Posted by Admin on 21 June 2011 | 3 Comments Tags: P This is a test.... 3 comments | Read the full post

  Read the article

• Designing rules to fight smallpox in Civ-style TBS games

  - by Williham Totland

  TL;DR: How do you design a ruleset for a Civ-style TBS game that prevents city smallpox from being a profitable or viable strategy? Long version: Civ-style games are pretty great. Bringing a civilization from cradle to grave is a great endeavor, and practicing diplomacy with hard-line human players is fun and challenging. In theory. In practice, however, many of these games has, especially in multiplayer, exactly one viable strategy: City smallpox, a.k.a. infinite city spread, a.k.a. covering all available space with 1-citizen cities, packed as tight as they will go. I suppose this could count as emergent gameplay, but still; it could hardly be considered to be in the spirit of the class of game. The Civilization series, of course, is stuck in their more or less fixed rule sets, established with Civilization. Yes, there have been major changes in some respects, but the rules pertaining to city building and maintenance have stayed pretty similar. So the question, then: If you build a ruleset for a TBS from the ground up; what rules should be in place to prevent Infinite City Sprawl from being a viable strategy? Or should ICS be a viable strategy?

  Read the article

• Is it possible to block traffic originating from a specific country?

  - by mickburkejnr

  Hi guys, My personal website is currently getting a lot of spam comments at the moment, and most of them originate from Russia (I've used Google Analytics to identify the traffic, and a lot of the links link to Russian sites). As it's a pain to keep deleting this comments, I would like to ban people from there commenting or visiting the website. Is this possible? Also, the website is using WordPress. Many thanks!

  Read the article

• How to batch remove spamming users and pages they created on MediaWiki?

  - by Problemania

  I'm trying to clean up a MediaWiki instance which has been subjected to spamming and vandalism for a period of time. The current status is that there are a large number of users which only created spam pages but typically not altered legitimate pages. And there is only < 10 users which I know are legitimate users and created a small number of legitimate pages. Abstractly, my idea of fixing the messy situation is to find the complete list of users that are not in that small set of legitimate users, and use RenameUser extension to rename them all to a Spammer user, and use Nuke extension to mass delete all pages it created. Any practical advice on how to proceed? Since there are hundreds of spammer users, how do I effectively rename them? It seems Renameuser extension does not support automated batch renaming of users by allowing users to be renamed with a list or file.

  Read the article

• Why do spammers use CELESTRON NEXTAR 6SE?

  - by fmz

  I am running a website for a volunteer organization that hosts an annual event. There is a form where people can volunteer to bring items for the event. All too frequently I get spam from users across the globe that enter things like this: Country - 1: Australia Material - 1: CELESTRON NEXTAR 6SE Country - 2: Australia Material - 2: C8 Newton Country - 3: Australia Material - 3: ETX 125EC Country - 4: Australia Material - 4: ETX 125EC Country - 5: Australia Material - 5: CELESTRON NEXTAR 6SE I don't really care about the country, but what is it with the telescope stuff? Is there some hidden meaning behind all this or is it some astronomy group that moonlights as spammers?

  Read the article

• Security as a Service (SecaaS) for Amazon EC2

  - by Dave

  I'm looking for a security as a service (SecaaS) provider or open source solution for Amazon EC2 instances, however I can't seem to find much on Google or elsewhere so was wondering if anyone knows where I could find this service? Ideally I'm looking for something that offers virtual firewalls, email and web security and virtual spam prevention. If anyone has any information on SecaaS i'd appreciate it, Thanks in advance

  Read the article

• aide --init show lots of errors

  - by newbie14

  I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide --init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or leave it ? /usr/sbin/prelink: /usr/sbin/lusermod: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/console-kit-daemon: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/NetworkManager: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/rtacct: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/tcpdump: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/dnsmasq: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/getsebool: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/ownership: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/modem-manager: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/pluginviewer: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/sasl2-shared-mechlist: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/ifdhandler: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/mklost+found: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/vpddecode: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/skdump: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/getpcaps: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lpasswd: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/tmpwatch: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/ck-log-system-stop: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/alternatives: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/avahi-daemon: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/dump-acct: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/luseradd: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/nstat: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/efibootmgr: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/sasldblistusers2: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/e2freefrag: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/sa: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lgroupadd: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/ss: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/dmidecode: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/sktest: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/fdformat: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/saslpasswd2: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/selinuxenabled: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/pppstats: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/wpa_supplicant: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/capsh: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/togglesebool: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/kppp: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lgroupmod: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/cracklib-unpacker: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/getcap: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/avcstat: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lnstat: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/filefrag: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lid: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/bonobo-activation-sysconf: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lockdev: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/mcelog: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/cifs.upcall: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/pcscd: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/brctl: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/logrotate: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/wpa_passphrase: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/pppdump: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/lsof: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/ck-log-system-start: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/setcap: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/rtkitctl: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/latencytop: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/wpa_cli: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process /usr/sbin/prelink: /usr/sbin/saned: at least one of file's dependencies has changed since prelinking Error on exit of prelink child process

  Read the article

• Can snort output an alert for a portscan (sfPortscan) to syslog?

  - by Jamie McNaught

  I've been working on this for too long now. I'm sure the answer should be obvious, but... Snort manual: http://www.snort.org/assets/125/snort_manual-2_8_5_1.pdf lists two logging outputs on pg 39 (pg 40 according to Acrobat Reader) as: "Unified Output" and "Log File Output" which I am guessing the former refers to the "unified" output mode... which makes me think the answer is "No, snort cannot output alerts for detected portscans to syslog." Config file I've been using is: alert tcp any 80 -> any any (msg:"TestTestTest"; content: "testtesttest"; sid:123) preprocessor sfportscan: proto { all } \ memcap { 10000000 } \ scan_type { all } \ sense_level { high } \ logfile { pscan.log } (yes, very basic I know). A simple nmap triggers output to the pscan.log Can anyone confirm this? Or point out how I do this?

  Read the article

• What response should be made to a continued web-app crack attempt?

  - by Tchalvak

  I've issues with a continuous, concerted cracking attempt on a website (coded in php). The main problem is sql-injection attempts, running on a Debian server. A secondary effect of the problem is being spidered or repeatedly spammed with urls that, though a security hole has been closed, are still obviously related attempts to crack the site, and continue to add load to the site, and thus should be blocked. So what measures can I take to: A: Block known intruders/known attack machines (notably making themselves anonymous via botnet or relaying servers) to prevent their repeated, continuous, timed access from affecting the load of the site, and B: report & respond to the attack (I'm aware that the reporting to law enforcement is almost certainly futile, as may be reporting to the ip/machine where the attacks are originating, but other responses to take would be welcome).

  Read the article

• Is it possible to detect nearby Wi-Fi enabled devices, not necessarily on the same network? [closed]

  - by Sky

  first question on StackExchange ever. I hope I got the right board. I'm trying to create a device (either from a standard AP or some other unconventional means) that will be able to detect nearby Wi-Fi enabled devices. For example, if a cellular phone (iPhone for instance) would be carried into the secured area, its MAC address will be logged. A cellular phone is a good example because it's the most common threat that should be detected. Some important points: The detection can be either active or passive, doesn't matter. The detected device might be connected to a different network, or might not be connected to anything at all. I assume most cellular phones are actively probing when not connected, but I'm not sure. It is important to not only identify the breach, but also to identify the device (MAC address). Conventional hardware is only optional. Distance of detection is at least 6 meters (20 feet). Handling one device at a time is good. Speed of detection is important, under 5 seconds is ideal. So my question is, is this even possible? If so, what can I use in order to make this a reality? Thank you for reading!

  Read the article

• Reinstall after a Root Compromise?

  - by Zoredache

  After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just fixing the hole that was used to compromise the system. Given all the various root kit technologies and other things a hacker can do most experts suggest you should reinstall the operating system. I am hoping to get a better idea why more people don't just take off and nuke the system from orbit. Here are a couple points, that I would like to see addressed. Are there conditions where a format/reinstall would not clean the system? Under what types conditions do you think a system can be cleaned, and when must you do a full reinstall? What reasoning do you have against doing a full reinstall? If you choose not to reinstall, then what method do you use to be reasonably confident you have cleaned and prevented any further damage from happening again.

  Read the article

• Are random packets normal?

  - by TheLQ

  About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway which comes with Snort and SnortSam. I enabled it, checked There is a total of 4 ports open, two of which forward to the server I'm talking about. These ports are 3724 and 8085, so they aren't going to be easily detected in a port scan. However checking some logs of this server I found that the attack is resuming. I found this ... Accepting connection from '75.166.155.122' [Auth] got unknown packet from '75.166.155.122' Accepting connection from '98.164.154.93' [Auth] got unknown packet from '98.164.154.93' Ping MySQL to keep connection alive Accepting connection from '70.241.195.129' [Auth] got unknown packet from '70.241.195.129' Accepting connection from '67.182.229.169' [Auth] got unknown packet from '67.182.229.169' Accepting connection from '69.137.140.38' [Auth] got unknown packet from '69.137.140.38' Accepting connection from '76.31.72.55' [Auth] got unknown packet from '76.31.72.55' Accepting connection from '97.88.139.39' [Auth] got unknown packet from '97.88.139.39' Accepting connection from '173.35.62.112' [Auth] got unknown packet from '173.35.62.112' Accepting connection from '187.15.10.73' [Auth] got unknown packet from '187.15.10.73' Accepting connection from '66.66.94.124' [Auth] got unknown packet from '66.66.94.124' Accepting connection from '75.159.219.124' [Auth] got unknown packet from '75.159.219.124' Accepting connection from '99.102.100.82' [Auth] got unknown packet from '99.102.100.82' Accepting connection from '24.128.240.45' [Auth] got unknown packet from '24.128.240.45' Accepting connection from '99.231.7.39' [Auth] got unknown packet from '99.231.7.39' Accepting connection from '206.255.79.56' [Auth] got unknown packet from '206.255.79.56' Accepting connection from '68.97.106.235' [Auth] got unknown packet from '68.97.106.235' Accepting connection from '69.134.67.251' [Auth] got unknown packet from '69.134.67.251' Accepting connection from '63.228.138.186' [Auth] got unknown packet from '63.228.138.186' Accepting connection from '184.39.146.193' [Auth] got unknown packet from '184.39.146.193' Accepting connection from '69.171.161.102' [Auth] got unknown packet from '69.171.161.102' Accepting connection from '76.0.47.228' [Auth] got unknown packet from '76.0.47.228' Ping MySQL to keep connection alive Accepting connection from '126.112.201.14' [Auth] got unknown packet from '126.112.201.14' Ping MySQL to keep connection alive Now that scares me. Why isn't Snort detecting this? How were they able to find this specific port? More importantly, what normally would these packets contain? Is this something I should be worried about? How can I stop this?

  Read the article

• Recommend alternative to tripwire?

  - by CarpeNoctem

  Looking for a host-based IDS comparable to tripwire. Preferably one that allows centralized management. Right now I use tripwire and though it works management and reporting through a central server would be ideal. I'm looking for recommendations that have actually been used and not just google results. Thanks!

  Read the article

• Finding how a hacked server was hacked

  - by sixtyfootersdude

  I was just browsing through the site and found this question: My server's been hacked EMERGENCY. Basically the question says: My server has been hacked. What should I do? The best answer is excellent but it raised some questions in my mind. One of the steps suggested is to: Examine the 'attacked' systems to understand how the attacks succeeded in compromising your security. Make every effort to find out where the attacks "came from", so that you understand what problems you have and need to address to make your system safe in the future. I have done no system admin work so I have no idea how I would start doing this. What would be the first step? I know that you could look in the server log files but as an attacker the first thing that I would do would be errasing the log files. How would you "understand" how the attacks succeeded?

  Read the article

• Blocking apache access via user agent string

  - by Tchalvak

  I've got a scripter who is using a proxy to attack a website I'm serving. I've noticed that they tend to access the site via software with a certain common user agent string (i.e. http://www.itsecteam.com/en/projects/project1_page2.htm "Havij advanced sql injection software" with a user_agent string of Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij). I'm aware that any cracking software worth it's salt will probably be able to modify it's user agent string, but I'm fine with the scripter having to deal with that feature at some point. So, is there any software out there for automatically blocking access & permanently blacklisting by matching user agent strings?

  Read the article

• My server's been hacked EMERGENCY

  - by Grant unwin

  I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a DOS attack on our provider. The servers access to the Internet has been shut down which means over 5-600 of our clients sites are now down. Now this could be an FTP hack, or some weakness in code somewhere. I'm not sure till I get there. How can I track this down quickly? We're in for a whole lot of litigation if I don't get the server back up ASAP. Any help is appreciated. UPDATE Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed to resolve this problem, although it may not apply to many others in a different situation. I'll detail what we did. We unplugged the server from the net. It was performing (attempting to perform) a Denial Of Service attack on another server in Indonesia, and the guilty party was also based there. We firstly tried to identify where on the server this was coming from, considering we have over 500 sites on the server, we expected to be moonlighting for some time. However, with SSH access still, we ran a command to find all files edited or created in the time the attacks started. Luckily, the offending file was created over the winter holidays which meant that not many other files were created on the server at that time. We were then able to identify the offending file which was inside the uploaded images folder within a ZenCart website. After a short cigarette break we concluded that, due to the files location, it must have been uploaded via a file upload facility that was inadequetly secured. After some googling, we found that there was a security vulnerability that allowed files to be uploaded, within the ZenCart admin panel, for a picture for a record company. (The section that it never really even used), posting this form just uploaded any file, it did not check the extension of the file, and didn't even check to see if the user was logged in. This meant that any files could be uploaded, including a PHP file for the attack. We secured the vulnerability with ZenCart on the infected site, and removed the offending files. The job was done, and I was home for 2 a.m. The Moral - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole world is made aware of the vulnerability. - Always do backups, and backup your backups. - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server Fault. Happy servering!

  Read the article

< Previous Page | 1 2 3 4 5 6 7 8 9 10 11 12  | Next Page >