Obciazenie Serwera , Atak?

[roten 0]

witam,

 

od paru dni mam duze zwiechy wklejam top: (chociaz to jest juz po wycieciu syfu, dalej w poscie...)

 

top - 21:11:30 up 3:01, 1 user, load average: 2.69, 2.64, 3.82

Tasks: 114 total, 4 running, 110 sleeping, 0 stopped, 0 zombie

Cpu(s): 68.1% us, 10.2% sy, 0.0% ni, 20.1% id, 0.7% wa, 0.3% hi, 0.7% si

Mem: 515936k total, 424568k used, 91368k free, 13220k buffers

Swap: 2096472k total, 132324k used, 1964148k free, 91512k cached

 

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

27524 apache 16 0 31032 11m 15m S 11.9 2.3 0:00.70 httpd

2012 apache 16 0 32388 12m 15m S 11.6 2.6 2:20.91 httpd

2522 apache 16 0 34564 14m 15m S 9.3 2.9 2:12.11 httpd

27741 apache 15 0 29644 9m 15m S 7.6 2.0 0:00.25 httpd

2517 apache 15 0 32632 13m 15m S 7.3 2.6 2:18.32 httpd

16721 apache 15 0 32480 13m 15m S 7.0 2.6 0:54.52 httpd

2016 apache 16 0 34380 14m 15m S 6.0 2.8 2:16.60 httpd

2434 apache 16 0 32484 12m 15m R 3.0 2.6 2:17.20 httpd

27789 mysql 17 0 39496 5204 5204 S 2.7 1.0 0:00.08 mysqld

2507 apache 16 0 32916 13m 15m S 1.0 2.6 1:43.89 httpd

27790 mysql 17 0 39496 5204 5204 S 0.7 1.0 0:00.02 mysqld

2009 mysql 16 0 39496 5204 5204 S 0.3 1.0 0:03.96 mysqld

2018 apache 15 0 32452 12m 15m S 0.3 2.6 2:13.55 httpd

2512 apache 15 0 32404 12m 15m S 0.3 2.6 2:07.88 httpd

2519 apache 16 0 32516 12m 15m S 0.3 2.6 2:15.54 httpd

19093 apache 15 0 32540 13m 15m S 0.3 2.6 0:37.40 httpd

1 root 16 0 1504 468 1352 S 0.0 0.1 0:00.65 init

2 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0

3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0

4 root 5 -10 0 0 0 S 0.0 0.0 0:03.42 events/0

5 root 5 -10 0 0 0 S 0.0 0.0 0:00.00 khelper

6 root 15 -10 0 0 0 S 0.0 0.0 0:00.00 kacpid

32 root 5 -10 0 0 0 S 0.0 0.0 0:00.78 kblockd/0

43 root 15 0 0 0 0 S 0.0 0.0 0:02.07 pdflush

44 root 16 0 0 0 0 S 0.0 0.0 0:32.38 kswapd0

45 root 5 -10 0 0 0 S 0.0 0.0 0:00.00 aio/0

181 root 25 0 0 0 0 S 0.0 0.0 0:00.00 kseriod

310 root 16 0 0 0 0 S 0.0 0.0 0:04.49 kjournald

799 root 15 0 0 0 0 S 0.0 0.0 0:00.00 khubd

996 root 25 0 0 0 0 S 0.0 0.0 0:00.00 pciehpd_event

1016 root 25 0 0 0 0 S 0.0 0.0 0:00.00 shpchpd_event

1906 root 16 0 2260 748 2092 S 0.0 0.1 0:00.20 syslogd

1909 root 17 0 2384 436 1344 S 0.0 0.1 0:00.13 klogd

1917 bind 18 0 29620 1784 4248 S 0.0 0.3 0:00.00 named

1926 root 16 0 2700 524 2368 S 0.0 0.1 0:00.07 da-popb4smtp

1945 nobody 22 0 5420 336 4936 S 0.0 0.1 0:00.57 directadmin

1949 mail 16 0 6500 1292 5680 S 0.0 0.3 0:00.03 exim

1957 nobody 20 0 5420 336 4936 S 0.0 0.1 0:00.00 directadmin

1958 nobody 20 0 5420 336 4936 S 0.0 0.1 0:00.00 directadmin

1959 nobody 20 0 5420 336 4936 S 0.0 0.1 0:00.00 directadmin

1960 nobody 20 0 5420 336 4936 S 0.0 0.1 0:00.00 directadmin

1961 nobody 22 0 5420 336 4936 S 0.0 0.1 0:00.00 directadmin

1971 root 16 0 25392 4364 15m S 0.0 0.8 0:02.34 httpd

1977 root 18 0 2240 640 2084 S 0.0 0.1 0:00.00 inetd

1982 root 18 0 2504 964 2380 S 0.0 0.2 0:00.02 mysqld_safe

2013 apache 16 0 32576 12m 15m S 0.0 2.5 2:10.37 httpd

2014 apache 16 0 32600 13m 15m S 0.0 2.6 2:08.20 httpd

2015 apache 16 0 32700 13m 15m S 0.0 2.6 2:10.34 httpd

2017 apache 16 0 32860 12m 16m S 0.0 2.5 2:11.56 httpd

2019 apache 16 0 32644 13m 15m S 0.0 2.6 2:21.91 httpd

 

W logach apacha mam:

 

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xx] Invalid URI in request Connection: Close

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xx] File does not exist: /home/xxx/domains/sharedip/400.shtml

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xxx] Invalid URI in request Connection: Close

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xx] File does not exist: /home/xxx/domains/sharedip/400.shtml

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xx] Invalid URI in request Connection: Close

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xxx] File does not exist: /home/txxx/domains/sharedip/400.shtml

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xxxx] Invalid URI in request Connection: Close

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xx] File does not exist: /home/txxx/domains/sharedip/400.shtml

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xx.xx] Invalid URI in request Connection: Close

[Wed Jan 31 21:13:52 2007] [error] [client 87.98.xxx.xx] File does not exist: /home/xxx/domains/sharedip/400.shtml

 

w/w ip blokuje regulkami iptables odcinam calkiem.

 

 

pozdrawiam

[p 3]

Skoro odcinasz to skad sie w logach pojawia?

[roten 0]

Skoro odcinasz to skad sie w logach pojawia?

 

pojawiaja sie ciagle nowe ip i je odcinam z palca ten zostawilem aby pokazac , zreszta teraz zaobserwowalem ze regulki iptables sie kasuja, nie mam pojecia co jest ...

[moron 0]

a czyje to ip? czasem nie googla?

[roten 0]

a czyje to ip? czasem nie googla?

np ns33491.ovh.net

[p 3]

A abuse@ovh.net nie dziala?

[roten 0]

A abuse@ovh.net nie dziala?

 

Pewnie dziala tak samo jak setki innych np home etc... raczej licze na zablokowanie tego.

 

 

Problem rozwiazany dzieki za zainteresowanie

 

 

pozdrawiam

[p 3]

Pewnie dziala tak samo jak setki innych np home etc... raczej licze na zablokowanie tego.

Jak nie wyslesz skargi + logow to napewno nie zadziala... To, ze home ma fatalny abuse@ nie znaczy, ze wszyscy taki maja...