Plesk Panel "Web Statistics" Permission Issue
15.04.2022
After a long break, we are starting to add documents to our blog page again that will help you manage your server better. Today we have prepared a short document that will be very useful for amateur server administrators. We hope you will never need the information written here, because the document is about attack detection.
Before starting this document, if you are not sufficiently knowledgeable about the netstat command, we strongly recommend reading and practicing the document we previously published on that topic.
On servers used for hosting purposes, there are usually many users sharing a server. Looking at the websites running in our customers’ IP ranges, an average of 300 to 800 websites are hosted on normal servers, and since it is not possible to assign a dedicated IP to each website now that IPv4 addresses have run out worldwide, this becomes impractical. When we consider the costs of attack prevention and whether the attack can be blocked depending on its size and nature, the goal in such shared hosting servers is generally to stop the service of the attacked website while preventing other users on the same server from being affected. If there are an average of 200 websites on an IP address and one of them is attacked, shutting down that IP address would also take down 199 innocent users. This document explains how to find which of the hosting accounts sharing the same IP address is being attacked.
First, it should be noted that there are many different types and sizes of attacks. We may not always technically be able to find which website the attack is targeting. In such cases, the resolution of the problem may cause long outages.
You can detect whether your server is under attack using the netstat or tcpdump command:
tcpdump -n not port 22The 22 above is your SSH port. You can also filter out your own computer’s IP address using grep:
tcpdump -n | grep -v YOUR-COMPUTER-IP-ADDRESSFor packet details, add -vvvv parameter:
tcpdump -n not port 22 -vvvvWhen an attacker targets a point, there is always a common point in the attack: a fixed destination port, fixed source port, fixed packet size, or fixed IP address. If we cannot block attacker IP addresses through software, we can find which website the requests are targeting from Apache access logs.
Example — if the suspected attacker IP is 10.0.0.249:
cd /usr/local/apache/domlogs/
find . -iname ‘*’ | xargs grep ‘10.0.0.249’ -slThe result of these commands will show which log file the IP address 10.0.0.249 appears in. Since log file names correspond to website names, we directly find the website being attacked.
However, this method only works for attacks coming via HTTP protocol over the web. For attacks coming through other ports, if there is no hardware firewall in between, the only thing we can do is shut down the attacked IP address and spread the accounts on this IP across as many free IP addresses as possible.
Leave a Comment
* Your comment will be published after approval.
Comments
0No comments yet. Be the first to comment!