Atomicorp

For those interested in seeing whats up in the CMS landscape on attacks. BF logins seem to be the same but, RFI is on the rise. http://www.imperva.com/docs/HII_Web_Application_Attack_Report_Ed5.pdf Atomic, may want to keep beefing up your WAF for file inclusion detection. The question becomes, will ...

For those running cPanel WHM 11.42 (release), just restart the mail and apache services and you should be good to go.

Test your servers here: http://filippo.io/Heartbleed/

Update: This is only true if you allow nightly updates to pull down from cPanel

Email sent

Thanks! Once I pay that, will I get access to the support ticket system? Right now, I can't login to that.

Well, it's time to to the deed then! I need a pro to install and get this rolling. My only fear is for our large Joomla install base and what might get caught in the ASL rules. Good news is I'm sure there will be a way to exclude some domains from those rules like CSF mod_sec control? That's our env...

Getting close to a decision here on the full ASL suite. The attacks are coming in waves with peaks and valleys. Looks like its a low level DDOS on WP and Joomla for admin and some scraping to check for vulnerable files. Would the full ASL help with this? See attached image.

Maybe, I put this rule in since the Joomla rule you have wasn't stopping the brute force attempts. Thought it might be related to ASL. <Location /administrator/index.php> # Setup brute force detection. # React if block flag has been set. SecRule user:bf_block "@gt 0" "deny,status:401,...

Thanks! What has kept us from going full ASL is when we tried to install it in the past, it made our production machine un-bootable and we had to perform an OS reload so, we're VERY skiddish on attempting to install ASL ourselves.

Was digging through the WIKI to figure out how to stop this errors: collections_remove_stale: Failed to access DBM file "/usr/local/apache/conf/modsec/data/msa/user": Permission denied collection_store: Failed to access DBM file "/usr/local/apache/conf/modsec/data/msa/ip": Permis...

Got it. The mod sec rules are limited without the full ASL?

OK, where are these settings for SHUN time? We're running the rules only with mod security. Thx

OK where do you do that?

We purchased a yearly subscription for the ASL rules and our system is being hit hard daily by bots trying to brute force the Joomla admin. What's bothersome is that your rules aren't banning those ip's and they just keep pounding away.

Is there a way to tweak that rule to ban IP's for 30 days?