We check for different types of attacks on our colocated server and ban the offending IP addresses for increasing amounts of time as the attacks continue. For instance, let’s say you’ve been trying to guess VPN accounts, which each generate an error. If you cross a threshold of say, 10 attempts, the IP address will be firewalled for a while. Once that time is up, the IP address can then access the ...
Introduction
This series was created because we had a problem with a hacker that infiltrated our system and sent out emails in early 2015. After discussing the information with a couple colleagues and their experiences dealing with similar issues I was encouraged to share what I had created and why.
In this part of the series, I’ll provide some of the SQL code for selecting from and ...
This series was created because we had a problem with a hacker that infiltrated our system and sent out emails in early 2015. After discussing the information with a couple colleagues and their experiences dealing with similar issues I was encouraged to share what I had created and why.
In this episode I’ll describe some of the details of the OS X Firewall and what was ...
As we saw on our previous entry of this series , we had a problem with a hacker that infiltrated our system and sent out emails.
There are three log files that are scanned for attacks, the system log, the mail log and the amavis log. They all have different formats, but they all contain the IP address of the machine contacting our server in the log line of the failed access attempt. The program ...
Early in 2015 one of the accounts on our server got hacked and was used to send out truckloads of spam emails. It took several hours for me to become aware of the issue, unfortunately. I only realized it once the number of bounces escalated to the point that our server was being blocked by other servers.
The account password was changed and some discussions were held with the user to see ...