<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Thanks Greg,
<br />
<br />I haven't had a change to install and test/observe DFix2 yet. And I didn't know that's how it operated.
<br />
<br />While I can imagine a few circumstances where that might accidentally lock out a valid user - I also know plenty of circumstances where it will stop a cracker trying to find a way in.
<br />
<br />I've got to spool up a new BX server soon. Looks like I'll have to install DFix2, and see how it goes.
<br />
<br />Thanks again.
<br />
<br />
<br />Chuck
<br />
<br /><font size="2">
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: Greg Kuhnert <gkuhnert@compassnetworks.com.au>
<br />
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />
Sent: Fri, 20 Sep 2013 18:09:26 +1000
<br />
Subject: [BlueOnyx:13712] Re: Message Log
<br />
<br />> Hi Chuck.
<br />>
<br />>
On 19/09/2013, at 2:55 AM, Chuck Tetlow <chuck@tetlow.net> wrote:
<br />>
<br />>
> Those log entries show that someone at 195.195.131.183 was trying to
connect to 192.168.250.240 on TCP port 80. So they're trying to hit the
webpage at the address 192.168.250.240, but were being blocked by the IPTables
firewall software on your BX server.
<br />>
>
<br />>
> Does that source address mean anything to you? What is on that
destination IP address, and does that site have a webpage? And probably
the most important question - why would the IPTables software be configured to
block someone hitting a webpage??
<br />>
>
<br />>
> I can't imagine DFix or one of the other automated security tools blocking
webpage requests to TCP Port 80, but I don't know all those packages well - so
it could be something automatic. But on first guess - I'd suggest someone
would have had to manually configure that block. That then goes back to
the last question - why would someone want to block access to a
webpage/website??
<br />>
<br />>
Once DFix detects a bad guy, it will block and log all traffic from that source,
including port 80. For example - it might detect on the SSH port, but it will
then block ALL ip traffic for a period of time. (Including port 80).
<br />>
<br />>
Check mail in your root / admin account from cron to find out what dFix is
blocking - that will help you understand why.
<br />>
<br />>
Greg.
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@mail.blueonyx.it
<br />>
<a target="_blank" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>