[BlueOnyx:22925] Re: APF mystery - blocking BlueOnyx

[Colin Jack]

Thanks Meaulnes.

I will have a read and see if I can get to the bottom of this.
Strange it should block BX though.

Regards

Colin

From: Blueonyx <blueonyx-bounces at mail.blueonyx.it> on behalf of "Meaulnes Legler @ MailList" <bluelist at waveweb.ch>
Organization: WaveWeb
Reply-To: BlueOnyx General Mailing List <blueonyx at mail.blueonyx.it>
Date: Monday, 27 May 2019 at 09:35
To: "blueonyx at mail.blueonyx.it" <blueonyx at mail.blueonyx.it>
Subject: [BlueOnyx:22924] Re: APF mystery - blocking BlueOnyx


Hello Colin

there were some posts about DFix2/APF round May 5-6 in this list, read what happened there...

I was running APF, Dfix2 and Fail2ban on my servers, but I turned Dfix2 off because it is too fussy with users who entered a false password (e.g. connecting an old device or setting up a new one, at the Internet Café etc.), one's connection is banned by Dfix2 already after two attempts.

less /etc/apf/deny_hosts.rules

# added 83.76.86.xxx on 12/04/18 12:09:33 with comment: dFixblock2

83.76.86.xxx

Dfix2 is very compelling, but just too strict. And since I couldn't find out how to edit the rules in /etc/sec, I turned it off keeping APF and Fail2ban only.

No problems anymore. Until the next hack?:-(

Best regards
_⌢_
'¿')
`-´

 Meaulnes Legler


 Zurich, Switzerland


+41¦0 44 260 16 60


On 26.05.19 09:16, Colin Jack wrote:
Hi Greg,
Hi Colin.

Look at /var/log/sec for anything that might indicate if it was dFix that blocked. If you see something there, we can tune to prevent that happening again.

GK

I did grep the log for the BX IPs but no result.
It is very weird – but I do like to run DFix2/APF on all my VPS and this is the only one doing strange stuff.

I will have another look and see if I can locate anything.

Thanks

Colin

On 23 May 2019, at 3:27 am, Colin Jack <colin at mainline.co.uk<mailto:colin at mainline.co.uk>> wrote:

I have a problem with one 5209R VPS that I cannot fathom.
I would be interested in some feedback.

I am running DFix2 / APF and APF appears to be blocking access to Blueonyx.it and also the Letsencrypt servers.
The GUI cannot get BX News or the shop.
LE renewals fail.

I haven’t touched any of the rules.

If I flush iptables it all starts working for a few hours.
If I disable AFP it all works.

I have looked in iptables for the BX IP but nothing.
Same with APF blacklist. Not listed.

I run DFix2 / APF on all my servers and don’t have a problem - except on this one.

Any thoughts (Michael/Greg)?

I have tried removing APF and re-installing without any luck.

Regards

Colin


_______________________________________________
Blueonyx mailing list
Blueonyx at mail.blueonyx.it<mailto:Blueonyx at mail.blueonyx.it>
http://mail.blueonyx.it/mailman/listinfo/blueonyx




_______________________________________________

Blueonyx mailing list

Blueonyx at mail.blueonyx.it<mailto:Blueonyx at mail.blueonyx.it>

http://mail.blueonyx.it/mailman/listinfo/blueonyx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20190527/457c7138/attachment.html>