Search found 14 matches

by heiny
Thu Feb 23, 2017 11:24 am
Forum: Atomic Protector (formerly ASL)
Topic: Multiple SASL authentication failures.
Replies: 2
Views: 9283

Re: Multiple SASL authentication failures.

Sorry for the waiting, we were investigating this issue. Every "false" positive we got are from Outlook 2007; postfix/smtpd[3349]: warning: CUSTOMER-IP: SASL DIGEST-MD5 authentication failed: authentication failure So we asked each of our customer who's using Outlook 2007 to modify their S...
by heiny
Wed Feb 01, 2017 10:43 am
Forum: Atomic Protector (formerly ASL)
Topic: Multiple SASL authentication failures.
Replies: 2
Views: 9283

Multiple SASL authentication failures.

Anyone else get a ton of Multiple SASL authentication failures since the last ASL update ?

Rules HIDs : 3357-3358-3359-3360

Image
by heiny
Tue Jan 31, 2017 2:57 pm
Forum: Atomic Protector (formerly ASL)
Topic: How to change HIDS rules for more than one server
Replies: 1
Views: 8272

How to change HIDS rules for more than one server

We own 7 ASL on Plesk (from Plesk 9.5 to 12.5) and want to change rules of HIDS 3357 (fast SASL authentification failure). We'd like to adjust frequency and timeframe for every server (with the same values). Is there a way to change it from the database (we use one database for all of our ASL) ? Onl...
by heiny
Fri Jan 27, 2017 12:49 pm
Forum: Atomic Protector (formerly ASL)
Topic: ASL 5 all sites are timing out
Replies: 1
Views: 8155

Re: ASL 5 all sites are timing out

Same for us. Server-Status from Apache: Current Time: Friday, 27-Jan-2017 11:40:21 EST Restart Time: Friday, 27-Jan-2017 10:05:57 EST Parent Server Generation: 2 Server uptime: 1 hour 34 minutes 24 seconds Total accesses: 47580 - Total Traffic: 1.7 GB CPU Usage: u681.08 s1307.07 cu8.41 cs0 - 35.3% C...
by heiny
Mon Nov 28, 2016 11:36 am
Forum: Atomic Protector (formerly ASL)
Topic: error mod_security since this week end
Replies: 4
Views: 7688

Re: error mod_security since this week end

We didn't fix that yet.

We disabled mod_sec in ASL for now. I was supposed to open a ticket last week about that. Will do it today.
by heiny
Fri Nov 25, 2016 11:09 am
Forum: Atomic Protector (formerly ASL)
Topic: error mod_security since this week end
Replies: 4
Views: 7688

Re: error mod_security since this week end

2 9901 ASLCommon::cmd_system ERROR: '/bin/cp -af /var/asl/rules/modsec/
template-* /var/asl/data/templates/ >/dev/
null 2>&1 (1)'
3 18 c_modsec::apply_rules Failed to copy file /var/asl/rules/modsec/
waf_classes -> /var/asl/data/waf_classes
by heiny
Mon Nov 21, 2016 3:03 pm
Forum: Atomic Protector (formerly ASL)
Topic: error mod_security since this week end
Replies: 4
Views: 7688

error mod_security since this week end

Got this: 2 9901 ASLCommon::cmd_system ERROR: '/bin/cp -af /var/asl/rules/modsec/ template-* /var/asl/data/templates/ >/dev/ null 2>&1 (1)' 3 18 c_modsec::apply_rules Failed to copy file /var/asl/rules/modsec/ waf_classes -> /var/asl/data/waf_classes When asl -s -f or aum -uf When I ls -l /var/a...
by heiny
Thu Nov 17, 2016 1:10 pm
Forum: Atomic Protector (formerly ASL)
Topic: Weird stuff - can't save eval
Replies: 1
Views: 4454

Re: Weird stuff - can't save eval

My programmer just found the answer ... The sentence was cheval (something)

So Joomla/ASL saw it as eval()

...

Good day : )
by heiny
Thu Nov 17, 2016 1:05 pm
Forum: Atomic Protector (formerly ASL)
Topic: Weird stuff - can't save eval
Replies: 1
Views: 4454

Weird stuff - can't save eval

I'm using Joomla and when I want to save a new post I got a mod_fcgi Timeout IF I use a word with "eval" in it. Like cheval (horse in french). I tested it, if I use chval or ch3val it save. Only hit in log > [warn] [client MyIP] (70007)The timeout specified has expired: mod_fcgid: can't ge...
by heiny
Tue Oct 18, 2016 8:22 am
Forum: Atomic Protector (formerly ASL)
Topic: CentOS 7/RHEL 7
Replies: 4
Views: 6267

Re: CentOS 7/RHEL 7

I got slow response websites on a Plesk 12.5 with ASL Kernel. Tested with https://www.webpagetest.org/ from 11s to 4s with and without ASL Kernel.

Except that no problem.
by heiny
Thu Oct 13, 2016 2:20 pm
Forum: Atomic Protector (formerly ASL)
Topic: Shared Blocklist
Replies: 0
Views: 4926

Shared Blocklist

I have multiple servers with ASL on each (6) and I'd like to know if there is a way to share blocklist between them ?
by heiny
Tue May 31, 2016 10:38 am
Forum: Atomic Protector (formerly ASL)
Topic: Blocklist limit before performance impact
Replies: 6
Views: 6727

Re: Blocklist limit before performance impact

hostingg wrote:what kernel is your system? u can run this command to find out
uname -r
2.6.32
by heiny
Mon May 30, 2016 9:44 am
Forum: Atomic Protector (formerly ASL)
Topic: Blocklist limit before performance impact
Replies: 6
Views: 6727

Re: Blocklist limit before performance impact

It's not that I need but that I can.

I just unchecked Enable Active Response timeout. Nothing is done manually.

When we blacklist/whitelist load is going sky crazy so I'm using blocklist as a kind of blacklist.
by heiny
Thu May 26, 2016 7:47 am
Forum: Atomic Protector (formerly ASL)
Topic: Blocklist limit before performance impact
Replies: 6
Views: 6727

Blocklist limit before performance impact

Is there a limit on how many IP can be block in blocklist before performance is affected ?

Is performance can be affected ?

I'm around 2500 now.


Thank you