| 02:12.34 | *** join/#uphpu itimber (~Adium@184.206.244.80) |
| 02:12.34 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 02:40.49 | *** join/#uphpu TodPunk (~Tod@50-198-177-186-static.hfc.comcastbusiness.net) |
| 02:55.11 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.101.200) |
| 02:55.11 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 03:01.40 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.101.200) |
| 03:01.40 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 03:11.49 | *** join/#uphpu kendsnyder (~Adium@70-57-90-106.slkc.qwest.net) |
| 03:11.49 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 07:14.50 | *** join/#uphpu supernovia (~Adium@2605:a601:525:d001:25ae:f7ff:137d:139) |
| 08:56.34 | *** join/#uphpu supernovia (~Adium@2605:a601:525:d001:9d92:ac16:27f8:7cc) |
| 12:59.37 | *** join/#uphpu eggyknap (~jtolley@unaffiliated/eggyknap) |
| 12:59.37 | *** mode/#UPHPU [+v eggyknap] by ChanServ |
| 13:57.14 | *** join/#uphpu josephscott (~josephsco@192.0.65.252) |
| 13:57.21 | *** mode/#UPHPU [+o josephscott] by ChanServ |
| 14:01.59 | *** join/#uphpu clintberry (~clintberr@205.197.215.90) |
| 14:01.59 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 14:17.14 | *** join/#uphpu supernovia (~Adium@2605:a601:525:d001:617d:ba5b:4922:fca2) |
| 14:53.18 | josephscott | curious to see what impact this has https://blog.cloudflare.com/introducing-universal-ssl/ |
| 14:55.06 | jsmith | josephscott: An error occurred during a connection to blog.cloudflare.com. The OCSP response contains out-of-date information. (Error code: sec_error_ocsp_old_response) |
| 14:55.20 | josephscott | haha |
| 14:55.25 | jsmith | Too funny... |
| 14:55.55 | josephscott | I'm using Chrome 38.0.2125.77 beta, didn't get an error |
| 14:58.11 | josephscott | I'm a fan of HTTPS'ing more things, but I'm not sure what to make of the cloudflare situation |
| 14:58.29 | josephscott | doesn't give the user an indication if traffic from cloudflare to the origin server is HTTPS |
| 14:58.55 | josephscott | then there is the single point of failure concern |
| 14:59.09 | josephscott | very curious to see how this all plays out |
| 15:00.47 | DexterTheDragon | "For a site that did not have SSL before, we will default to our Flexible SSL mode, which means traffic from browsers to CloudFlare will be encrypted, but traffic from CloudFlare to a site's origin server will not." |
| 15:01.40 | josephscott | yep, which leaves the end user with no idea how far the HTTPS actually goes |
| 15:01.53 | josephscott | unless they dig deeper, which really, no one does |
| 15:02.38 | jsmith | Gotta love man in the middle attacks |
| 15:02.54 | *** join/#uphpu kendsnyder (~Adium@67.214.245.39) |
| 15:02.54 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 15:05.19 | josephscott | http://mitmproxy.org/ |
| 15:19.38 | *** join/#uphpu TuxToaster (~TuxToaste@inferno.apxalarm.com) |
| 15:19.38 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 15:47.10 | mgeary | morning folks |
| 15:48.24 | mgeary | iâve got a client with a server that is running a WP instance. They are getting some fatal/non-recoverable database errors once or twice a day. Basically the mysql server is going away. My theory is that some bot(s) are slamming the site, attempting to exploit it, and the vmware is killing the mysql |
| 15:49.13 | mgeary | whatâs the best way to try to address this? Configure apache to not allow so many connections? |
| 15:51.37 | herlo | mgeary: when we ran into this with a different product, the ddos was hitting specific urls. Maybe look for that? |
| 15:52.15 | *** join/#uphpu undertakingyou (~undertaki@neutroninteractive-xmission.xmission.com) |
| 15:52.20 | mgeary | and then what..? |
| 15:52.21 | *** mode/#UPHPU [+v undertakingyou] by ChanServ |
| 15:52.44 | mindjuju | hi mgeary, do you have access to the apache access logs, i bet i can call whats happening from here |
| 15:52.51 | mindjuju | it's prolly OOM on mysql |
| 15:52.52 | herlo | mgeary: then you can do a block for a specific ip in apache? |
| 15:53.03 | mindjuju | and the access you're looking for is hits to /xmlrpc.php |
| 15:53.21 | herlo | mindjuju: looks like you've had some experience with this? :) |
| 15:53.29 | mindjuju | i have a site that gets maybe 100 hits a day suddently go to 6 requests / sec |
| 15:53.32 | mindjuju | tanked it several times over |
| 15:53.38 | mindjuju | herlo, yup |
| 15:53.44 | herlo | :) |
| 15:53.45 | mindjuju | ccraze runs ... |
| 15:53.51 | mgeary | and yes, i have full root access to the machine |
| 15:53.53 | mindjuju | 5 wp blogs |
| 15:53.54 | herlo | mgeary: seriously, listen to the mindjuju |
| 15:53.58 | mindjuju | had to think there for a sec |
| 15:54.08 | mgeary | checking |
| 15:54.58 | mgeary | mindjuju: sure enough |
| 15:55.04 | mindjuju | :) |
| 15:55.07 | mgeary | tons of posts to that url, with 500 errors |
| 15:55.18 | mgeary | whatâd you do, just write an apache forbidden to that url? |
| 15:55.19 | mindjuju | oh good, so you've got that blocked |
| 15:55.34 | herlo | mgeary: that's what I was going to suggest. |
| 15:55.59 | mindjuju | yeah, and then told CSF to enable DDoS |
| 15:56.11 | mgeary | CSF? |
| 15:56.26 | mindjuju | my iptables kung fu isn't legendary like herlo's prolly is |
| 15:56.46 | mindjuju | so i cheated and have csf on there, i'll find you a link, but it's a crutch to help config iptables |
| 15:57.17 | herlo | iptables rate-limit is probably what you are wanting. |
| 15:57.22 | mindjuju | but you can config iptables to block the request even before apache sees it. |
| 15:57.25 | mindjuju | yep, sounds right |
| 15:57.33 | mindjuju | so herlo, here is the question though |
| 15:57.57 | mindjuju | if i iptables rate limit (assuming its the same as csf) v apache forbid |
| 15:57.58 | herlo | http://www.microhowto.info/howto/limit_the_rate_of_inbound_tcp_connections_using_iptables.html <-- this may help. |
| 15:58.16 | mindjuju | is that just 6 of one, half a dozen of another as far as system resources required to defend the computer? |
| 15:59.20 | herlo | no |
| 15:59.27 | herlo | mindjuju: multiple layers of defence. |
| 15:59.39 | mindjuju | ah good call |
| 15:59.47 | mindjuju | there ya go mgeary :) |
| 15:59.48 | herlo | defence, defense. Depending on whether you are a Brit or not. :) |
| 16:00.28 | mgeary | thanks. have a deny now on that location in the virtualhost config |
| 16:00.34 | mgeary | will look into the iptables solution, too |
| 16:00.50 | mindjuju | and to make you doubly happy mgeary (as you used to run a collection jar to get me a MBP), Tiff upgraded her Air to MBP and her air now sits on Corban's desk |
| 16:01.16 | mgeary | sweet |
| 16:01.21 | mindjuju | oh, one last thing mgeary, try to find some auto way to handle the ip block, there are many many ips that are launching that attack |
| 16:01.36 | mgeary | well, yeah. thatâs why i donât feel an IP-centric approach is viable |
| 16:01.49 | mgeary | but if i just block it at the apache level, that should at least spare the database |
| 16:01.51 | mindjuju | see, that's where csf comes in, it does do that |
| 16:02.10 | mindjuju | detects the assaulting IP, and auto block for 30 minutes, (you specify time) |
| 16:02.28 | mgeary | never worked with csf before |
| 16:02.48 | mindjuju | it's a crutch, I REALLY need to spend some quality time with iptables |
| 16:03.01 | mindjuju | i'll find you the link |
| 16:03.19 | herlo | mindjuju: actually, sounds like csf is a good fit there. iptables doesn't do temporary things like that... I'm guessing csf has a cron job or a polling tool. |
| 16:03.30 | mindjuju | yup |
| 16:03.41 | herlo | which sets and removes the rules within iptables. |
| 16:03.59 | mindjuju | here are the instructions i followed |
| 16:04.02 | mindjuju | http://www.liquidweb.com/kb/csf-config-server-firewall-installation/ |
| 16:04.25 | mindjuju | still though, every now and then I get hit with an IPtables q that i struggle with |
| 16:04.50 | mindjuju | i'd love to be able to brain through those q without looking up, or maybe just a reference glance |
| 16:04.54 | mindjuju | but i'm getting there ;) |
| 16:36.35 | *** join/#uphpu kendsnyder (~Adium@67.214.245.39) |
| 16:36.35 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 16:46.42 | *** join/#uphpu bbankes (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 17:42.12 | ninnypants | tierra: ping |
| 17:49.02 | *** join/#uphpu bbankes_ (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 17:50.00 | *** join/#uphpu bbankes__ (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 17:53.22 | *** join/#uphpu clintberry (~clintberr@205.197.215.90) |
| 17:53.23 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 18:37.51 | *** join/#uphpu kendsnyder (~Adium@67.214.245.39) |
| 18:37.51 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 18:56.59 | *** join/#uphpu bbankes (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 20:25.45 | *** join/#uphpu bbankes (~bbankes@50-200-100-242-static.hfc.comcastbusiness.net) |
| 20:31.01 | tierra | ninnypants: sup? |
| 20:38.40 | *** join/#uphpu SunSparc (~jonathan@50.252.130.118) |
| 20:38.42 | *** mode/#UPHPU [+v SunSparc] by ChanServ |
| 20:54.49 | *** join/#uphpu Heartsbane (tsharpe@unaffiliated/heartsbane) |
| 20:54.49 | *** mode/#UPHPU [+v Heartsbane] by ChanServ |
| 20:57.07 | *** join/#uphpu UtahDave (~boucha@rrcs-198-24-97-2.central.biz.rr.com) |
| 20:57.22 | *** mode/#UPHPU [+o UtahDave] by ChanServ |
| 21:17.03 | josephscott | trying out http://grafana.org/ since it is already in use at work :-) |
| 21:26.53 | tierra | josephscott: I had that implemented for MOJO in a testing environment, though it was never pushed to production |
| 21:27.21 | tierra | it's definitely the best Graphite dashboard I found (and I looked through tons of them) |
| 21:27.41 | tierra | very slick |
| 21:33.57 | josephscott | yeah, definitely liking it, just took some muddling around to figure out to set up some of the graphs and dashboards |
| 23:42.23 | *** join/#uphpu supernovia (~Adium@2605:a601:525:d001:ddd2:43f3:9bf5:e86b) |