Atomicorp

We're working on an alternative though. Either proxy on the plesk server so its no longer exposed to the broader Internet and run it through apache so we can control all access to it or ossec to catch the event and shun. In the short term, you could do that now manually as we're not quite ready to o...

What happens on your machine if you run these commands:

nslookup www.atomicorp.com

and

wget http://www.atomicorp.com/channels/atomi ... repomd.xml

You do know that Scott and I are Plesk founders right? So you can safely ignore the fact that we are not upgrading our boxes to 9.0 right now.

Seriously, always wait for a point release with most products, except ASL of course! We NEVER have any bugs in our products either!

As root run this command:

iptables -L -n | grep DROP

And do you see attacks being detected?

Also is active response turned on?

grep -i response /etc/asl/config

OSSEC_ACTIVE_RESPONSE="on"

Is this happening Is this on the same server you having other problems with?

Is this happening on the system you are having other issues with?

And please don't hesitate to let us know about any false positives. Our goal is to have no FPs and we always appreciate it when we are informed of a false positive, it just helps us to make a better product.

And again, thank you again for your report.

Thank you for the report. Please try updating your rules - we just put out an update for this false positive - and please feel free to email support@atomicorp.com or simply press the "Report False Positive" button in the ASL GUI if you run into any problems with the rules again. We are fan...

If your are running ASL, just go into the ASL GUI and click on the event that is blocking access to your application. Then you can press the "Report False Positive" button and it will be sent directly to support for resolution. We generally have these issues resolved the same day and durin...

Or if you are running ASL, what do you see in the alert GUI?

Its most likely a false positive, if you post the false positive here we can put out an update today for the rules.

You're still using mod_cache which could be part of the problem, mom_mem_cache is a sub-module for mod_cache. So try turning mod_cache off as well, and make sure you turn off these two modules as well (they shouldnt work without mod_cache): LoadModule disk_cache_module modules/mod_disk_cache.so Load...

Which apache modules are loaded on the boxes where you see this happen?

No release date has been set however. If you want to request features, please check out the new ASW forum.

http://atomicrocketturtle.com/forum/viewforum.php?f=9

And does this only happen with VPS systems?

The FAQ has been moved to the wiki:

https://www.atomicorp.com/wiki/index.php/ASL_FAQ