0

I am confused to why this has started to happen. On my local network, if I click 10-20 apache/http links my server will decide to add me hosts.deny file and block me on iptables.

Its not just apache, it seems to happen with any kinda of traffic, that comes in on a flood method. Like I use subsonic, if I change tracks 10-20 times, it will do it.

I would assume I have some sort of firewall which is sitting on the server which is doing this. However I do not have fail2ban or any denyhosts in /var/lib.

I cannot work out why I keep getting added to hosts.deny/iptables.

Thanks

  • 1
    You have some sort of service running , psad, fail2ban, something. Check the logs. – Panther Jun 11 '14 at 16:20
0

According to Apache documentation:

"Often the most effective anti-DoS tool will be a firewall or other operating-system configurations. For example, most firewalls can be configured to restrict the number of simultaneous connections from any individual IP address or network, thus preventing a range of simple attacks. Of course this is no help against Distributed Denial of Service attacks (DDoS)."

On linux tcp wrapper is a host-based Networking ACL system, used to filter network access to Internet.

I suggest verify if is installed portsentry that can block DoS attack via hosts.deny and firewall rule (iptables).

  • thanks for you reply. It does seem to mainly happen when I go to apache. I have checked and do not have portsentry, psad or fail2ban. I have ufw (which comes default with ubuntu). Still cannot work out for the life of me why I keep getting added to hosts.deny. Looked through my dpkg log and cannot see anything either. – Sc0rian Jun 12 '14 at 14:42
  • please, can you post the output of sudo iptables -L – Lety Jun 12 '14 at 20:13
  • well currently it is blank. but everytime I go to the zabbix dashboard, the pc gets added to iptables, drop. – Sc0rian Jun 14 '14 at 18:38
  • may be zabbix can limit incoming tcp connection, verify active agent configuration – Lety Jun 14 '14 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.