httpd ve whm problemi

sverdlow · 26 Eylül 2007

merhabalar,
dedicated makinede whm'e ve diğer tüm sitelere erişemiyorum, sadece ssh erişimim var.
ve sık sık httpd failed emaili geliyor. restart yapıyrum servisleri, reboot yapıyorum bir türlü olmuyor.
acil bir fikri olan var mı?
edit: başlık şöyle olmalıydı: httpd ve whm problemi

iDealhosting.org · 26 Eylül 2007

ssh de service restart httpd veya service restart cpanel
komutları ile servisleri yeniden baslatın, ssh den bakın saldırı varmı, girmiyorken server load'ı ne durumda gösteriyor.

sverdlow · 26 Eylül 2007

iDealhosting.org' Alıntı:
ssh de service restart httpd veya service restart cpanel
komutları ile servisleri yeniden baslatın, ssh den bakın saldırı varmı, girmiyorken server load'ı ne durumda gösteriyor.

restartlar işe yaramıyor,
server yükü 0.1 civarı dolaşıyor, sanırım saldırı yok, ipleri kontrol ettim ama gözüme bişey çarpmadı.
sunucu göçtü mü acaba, anlamadım gitti.

Angelo · 26 Eylül 2007

ps aux
ve
iptables -L INPUT
çıktılarını paste et.

sverdlow · 26 Eylül 2007

Angelo' Alıntı:
ps aux
ve
iptables -L INPUT
çıktılarını paste et.

iptables -L INPUT

Kod:

target     prot opt source               destination

iptables kurulu olup olmadığını bilmiyorum.
ps aux çıktısı

Kod:

USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  2472  544 ?        S    Sep25   0:01 init [3]
root         2  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/0]
root         3  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/0]
root         4  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/1]
root         5  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/1]
root         6  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/2]
root         7  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/2]
root         8  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/3]
root         9  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/3]
root        10  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/4]
root        11  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/4]
root        12  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/5]
root        13  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/5]
root        14  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/6]
root        15  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/6]
root        16  0.0  0.0     0    0 ?        S    Sep25   0:00 [migration/7]
root        17  0.0  0.0     0    0 ?        SN   Sep25   0:00 [ksoftirqd/7]
root        18  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/0]
root        19  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/1]
root        20  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/2]
root        21  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/3]
root        22  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/4]
root        23  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/5]
root        24  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/6]
root        25  0.0  0.0     0    0 ?        S<   Sep25   0:00 [events/7]
root        26  0.0  0.0     0    0 ?        S<   Sep25   0:00 [khelper]
root        27  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kacpid]
root        72  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/0]
root        73  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/1]
root        74  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/2]
root        75  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/3]
root        76  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/4]
root        77  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/5]
root        78  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/6]
root        79  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kblockd/7]
root        80  0.0  0.0     0    0 ?        S    Sep25   0:00 [khubd]
root        97  0.0  0.0     0    0 ?        S    Sep25   0:00 [pdflush]
root        98  0.0  0.0     0    0 ?        S    Sep25   0:02 [pdflush]
root        99  0.0  0.0     0    0 ?        S    Sep25   0:01 [kswapd0]
root       100  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/0]
root       101  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/1]
root       102  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/2]
root       103  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/3]
root       104  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/4]
root       105  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/5]
root       106  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/6]
root       107  0.0  0.0     0    0 ?        S<   Sep25   0:00 [aio/7]
root       251  0.0  0.0     0    0 ?        S    Sep25   0:00 [kseriod]
root       525  0.0  0.0     0    0 ?        S    Sep25   0:00 [scsi_eh_0]
root       551  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/0]
root       552  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/1]
root       553  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/2]
root       554  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/3]
root       555  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/4]
root       556  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/5]
root       557  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/6]
root       558  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata/7]
root       559  0.0  0.0     0    0 ?        S<   Sep25   0:00 [ata_aux]
root       588  0.0  0.0     0    0 ?        S    Sep25   0:03 [kjournald]
root      1807  0.0  0.0  3264  456 ?        S<s  Sep25   0:00 udevd
root      2187  0.0  0.0     0    0 ?        S<   Sep25   0:00 [kauditd]
root      2469  0.0  0.0     0    0 ?        S    Sep25   0:00 [kjournald]
root      2883  0.0  0.0  6752  432 pts/0    S    00:17   0:00 postsuexecinstall
root      2968  0.0  0.0     0    0 ?        S<   Sep25   0:00 [loop0]
root      2979  0.0  0.0     0    0 ?        S    Sep25   0:00 [kjournald]
root      3510  0.0  0.0  1792  540 ?        Ss   Sep25   0:00 syslogd -m 0
root      3514  0.0  0.0  3312  384 ?        Ss   Sep25   0:00 klogd -x
root      3527  0.0  0.0  1636  296 ?        Ss   Sep25   0:00 irqbalance
root      3536  0.0  0.0  2436  392 ?        S    Sep25   0:00 /usr/sbin/courier
root      3537  0.0  0.0  2492  608 ?        S    Sep25   0:00 /usr/libexec/cour
root      3564  0.0  0.0  2492  256 ?        S    Sep25   0:00 /usr/libexec/cour
root      3565  0.0  0.0  2492  256 ?        S    Sep25   0:00 /usr/libexec/cour
root      3566  0.0  0.0  2492  256 ?        S    Sep25   0:00 /usr/libexec/cour
root      3567  0.0  0.0  2492  256 ?        S    Sep25   0:00 /usr/libexec/cour
root      3568  0.0  0.0  2492  256 ?        S    Sep25   0:00 /usr/libexec/cour
root      3615  0.0  0.0  3404  352 ?        S    Sep25   0:00 /usr/sbin/smartd
root      3624  0.0  0.0  3432  444 ?        Ss   Sep25   0:00 /usr/sbin/acpid
root      3634  0.0  0.0  8324 2068 ?        Ss   Sep25   0:00 cupsd
root      3717  0.0  0.0  5260 1136 ?        Ss   Sep25   0:00 /usr/sbin/sshd
root      3739  0.0  0.0  2388  768 ?        Ss   Sep25   0:00 xinetd -stayalive
root      3748  0.0  0.0  5692 1232 ?        S    Sep25   0:00 /bin/sh /usr/bin/
mysql     3769  0.1  4.4 1650264 186440 ?    Sl   Sep25   0:08 /usr/sbin/mysqld
root      3805  0.0  0.0  2252  392 ?        S    Sep25   0:00 /usr/sbin/courier
root      3806  0.0  0.0  3504  504 ?        S    Sep25   0:00 /usr/lib/courier-
root      3812  0.0  0.0  2372  300 ?        S    Sep25   0:00 /usr/sbin/courier
root      3813  0.0  0.0  2136  480 ?        S    Sep25   0:00 /usr/lib/courier-
root      3818  0.0  0.0  2644  392 ?        S    Sep25   0:00 /usr/sbin/courier
root      3819  0.0  0.0  1832  504 ?        S    Sep25   0:00 /usr/lib/courier-
root      3824  0.0  0.0  2084  300 ?        S    Sep25   0:00 /usr/sbin/courier
root      3825  0.0  0.0  2328  480 ?        S    Sep25   0:00 /usr/lib/courier-
root      4118  0.0  0.0  5708  944 ?        Ss   Sep25   0:00 crond
root      4163  0.0  0.0  6712 1120 ?        Ss   Sep25   0:00 pure-ftpd (SERVER
root      4166  0.0  0.0  7112  672 ?        S    Sep25   0:00 /usr/sbin/pure-au
xfs       4174  0.0  0.0  4476 1072 ?        Ss   Sep25   0:00 xfs -droppriv -da
mailnull  4322  0.0  0.1  7096 4256 ?        S    Sep25   0:00 eximstats
root      4400  0.0  0.2 14624 8600 ?        S    Sep25   0:00 cpdavd - acceptin
root      4407  0.0  0.0  6536 4028 ?        S    Sep25   0:00 cpbandwd
root      4408  0.0  0.1 10392 7068 ?        SN   Sep25   0:00 cpanellogd - slee
mailman   4477  0.0  0.1 12012 4876 ?        Ss   Sep25   0:00 /usr/local/bin/py
mailman   4479  0.0  0.1 11532 6692 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4480  0.0  0.1 10468 6628 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4481  0.0  0.1 11868 6628 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4482  0.0  0.1 10408 6616 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4483  0.0  0.1 11712 6644 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4484  0.0  0.1 11428 6688 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4485  0.0  0.1 10372 6688 ?        S    Sep25   0:00 /usr/local/bin/py
mailman   4486  0.0  0.1 11316 6616 ?        S    Sep25   0:00 /usr/local/bin/py
named     4508  0.0  0.0 110388 3752 ?       Ssl  Sep25   0:00 /usr/sbin/named -
dbus      4518  0.0  0.0  2616  800 ?        Ss   Sep25   0:00 dbus-daemon-1 --s
root      4537  0.0  0.1  8420 6192 ?        Ss   Sep25   0:01 hald
root      4540  0.0  0.1 10592 5084 pts/0    S    00:27   0:00 chkservd
root      4575  0.0  0.0  1488  396 ?        Ss   Sep25   0:00 /usr/sbin/portsen
root      4651  0.0  0.0  6224 1036 pts/0    T    00:29   0:00 /bin/sh /sbin/ser
root      4698  0.0  0.0  1700  388 tty1     Ss+  Sep25   0:00 /sbin/mingetty tt
root      4699  0.0  0.0  3284  388 tty2     Ss+  Sep25   0:00 /sbin/mingetty tt

sverdlow · 26 Eylül 2007

ps aux un devamı

Kod:

root      4700  0.0  0.0  3284  388 tty3     Ss+  Sep25   0:00 /sbin/mingetty tt
root      4701  0.0  0.0  3092  384 tty4     Ss+  Sep25   0:00 /sbin/mingetty tt
root      4702  0.0  0.0  3272  384 tty5     Ss+  Sep25   0:00 /sbin/mingetty tt
root      4703  0.0  0.0  3436  388 tty6     Ss+  Sep25   0:00 /sbin/mingetty tt
root      4869  0.0  0.0     0    0 pts/0    Z    00:29   0:00 [httpd] <defunct>
root      4871  0.0  0.0  7420 1880 pts/0    T    00:29   0:00 lynx -dump http:/
root      4872  0.0  0.0  5624  688 pts/0    T    00:29   0:00 awk  /process$/ {
root      5540  0.0  0.0  8988 3532 ?        Ss   Sep25   0:00 sshd: root@notty
root      5550  0.0  0.0  4280 1292 ?        Ss   Sep25   0:00 /usr/libexec/open
root      6691  0.0  0.0  8080 2364 ?        Rs   Sep25   0:00 sshd: root@pts/0
root      6696  0.0  0.0  5524 1472 pts/0    Ss   Sep25   0:00 -bash
root      6780  0.0  0.0  3408 1044 pts/0    T    Sep25   0:00 top
root      6821  0.0  0.0  6296 1196 ?        S    01:00   0:00 crond
root      6827  0.3  0.1  8172 5588 ?        SNs  01:00   0:03 /scripts/cpbackup
mailnull  6943  0.0  0.0  8988 1932 ?        S    01:00   0:00 /usr/sbin/sendmai
root      7272  0.0  0.2 20688 10176 ?       S    01:02   0:00 cpsrvd - waiting
root      8164  0.0  0.1 15084 6212 ?        Ss   01:12   0:00 /usr/local/apache
nobody    8172  0.0  0.1 15084 4596 ?        S    01:12   0:00 /usr/local/apache
nobody    8173  0.0  0.1 15084 4596 ?        S    01:12   0:00 /usr/local/apache
nobody    8174  0.0  0.1 15084 4596 ?        S    01:12   0:00 /usr/local/apache
nobody    8175  0.0  0.1 15084 4596 ?        S    01:12   0:00 /usr/local/apache
nobody    8176  0.0  0.1 15084 4596 ?        S    01:12   0:00 /usr/local/apache
nobody    8186  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8187  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8188  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8189  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8190  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8191  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8192  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8193  0.0  0.1 15084 4584 ?        S    01:12   0:00 /usr/local/apache
nobody    8194  0.0  0.1 15084 4584 ?        S    01:12   0:00 /usr/local/apache
nobody    8195  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8196  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8197  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8198  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8199  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8200  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8201  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8202  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8203  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8204  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8205  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8206  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8207  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8208  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8209  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8210  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8211  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8212  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8213  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8214  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8216  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8217  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8218  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8219  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8224  0.0  0.1 15384 5756 ?        S    01:12   0:00 /usr/local/apache
nobody    8225  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8226  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8227  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8230  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8231  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8232  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8234  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8238  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8244  0.0  0.1 15084 4588 ?        S    01:12   0:00 /usr/local/apache
nobody    8326  0.0  0.1 15084 4588 ?        S    01:13   0:00 /usr/local/apache
nobody    8327  0.0  0.1 15084 4588 ?        S    01:13   0:00 /usr/local/apache
nobody    8328  0.0  0.1 15084 4588 ?        S    01:13   0:00 /usr/local/apache
nobody    8329  0.0  0.1 15084 4588 ?        S    01:13   0:00 /usr/local/apache
nobody    8330  0.0  0.1 15084 4588 ?        S    01:13   0:00 /usr/local/apache
nobody    8339  0.0  0.1 15084 4588 ?        S    01:14   0:00 /usr/local/apache
root      8340  0.0  0.0  4160  792 pts/0    R+   01:14   0:00 ps aux
root     22553  0.0  0.7 34276 30556 ?       Ss   00:13   0:01 /usr/sbin/clamd
mailnull 22557  0.0  0.0  7820 1124 ?        Ss   00:13   0:00 /usr/sbin/exim -b
mailnull 22563  0.0  0.0  9344 1144 ?        Ss   00:13   0:00 /usr/sbin/exim -b
mailnull 22570  0.0  0.0  7740 1068 ?        Ss   00:13   0:00 /usr/sbin/exim -t
root     22585  0.0  0.6 29516 25560 ?       Ss   00:13   0:00 /usr/bin/spamd -d
root     22607  0.0  0.0  4480 1412 ?        S    00:13   0:00 antirelayd
root     22608  0.0  0.6 29776 25320 ?       S    00:13   0:00 spamd child
root     22609  0.0  0.6 29780 25316 ?       S    00:13   0:00 spamd child

CyberTurk · 26 Eylül 2007

pico /usr/local/apache/conf/httpd.conf ile httpd.conf u açıp değerleri aşağıdaki şekilde değiştirip restart atsana makinaya

"Timeout 300"
"KeepAlive off"
"MinSpareServers 8"
"MaxSpareServers 13"
"MaxRequestsPerChild 50"

sverdlow · 26 Eylül 2007

syn saldırısı var galiba;

Kod:

      1 213.139.198.2
      1 59.94.243.108
      1 85.110.60.99
      1 87.118.163.142
      1 88.242.219.3
      1 88.246.159.60
      1 88.254.93.248
      2 88.246.68.89
      2 88.254.88.187
      3 85.103.240.143
      3 85.96.5.71
      4 85.100.224.170
      4 85.96.36.114
      4 85.97.52.235
      4 86.106.201.36
      4 88.235.169.0
      5 81.215.160.222
      5 81.240.24.74
      6 85.96.217.218
      6 85.98.45.13
      6 88.230.198.186
      7 89.247.28.61
      8 85.108.4.23
      8 88.240.119.226
      9 88.231.65.18
     10 85.99.46.132
     10 88.254.71.35
     12 193.201.130.124
     14 88.224.52.87
     16 85.96.167.7
     16 88.231.26.54
     17 85.97.93.57
     17 85.98.169.175
     17 88.231.18.212
     17 88.234.209.102
     18 85.108.13.8
     18 88.243.211.113
     19 88.238.67.94
     19 88.242.225.11
     21 88.241.21.48
     27 88.232.159.106
     31 85.98.11.7
     32 85.102.80.196
     36 88.235.71.190
     43 81.214.166.148
     43 88.227.158.39
     45 78.180.64.108
     47 78.181.8.202
     54 88.243.34.127
     73 81.213.67.170

sverdlow · 26 Eylül 2007

arkadaşlar, bu tür durumlar için bir çözüm yokmudur?
csf de işe yaramıyor gibi.

deviL · 26 Eylül 2007

apf dene ?

sverdlow · 26 Eylül 2007

peki saldırı sona erdiğinde sunucunun kendine gelmesi ne kadar zaman alıyor (5000 client için)?

CyberTurk · 26 Eylül 2007

yukardaki bağlantılardan saldırı olduğunu nasıl çıkardın anlamış değilim. Site boşken mi aldın o değerleri? Apacheni optimize etsen sorun kalmaz bence.

httpd ve whm problemi

0

0

0

0

0

0

0

0

0

0

0

0

Backlink ve Tanıtım Yazısı için iletişime geçmek için Skype Adresimiz: .cid.1580508955483fe5