FRIHOST FORUMS SEARCH FAQ TOS BLOGS COMPETITIONS
You are invited to Log in or Register a free Frihost Account!


My account is not working





manfer
My account stopped working today.

I really don't know if it has something to do with the move of VPS1 -though from the announcement I don't understand server4 is being moved-.

The account is from server4 and it doesn't seems to be a server responding at the server4 IP 176.9.110.136

So the server is down or it has been moved or ... I don't know. It just doesn't work.

Any insight of which is the problem?

Thanks
manfer
Ok I have tested in downforeveryoneorjustme and it says the server is up so then I have to guest I'm blocked on the server. And if so I don't understand why.

Any insights?

Regards
Bondings
Your ip address was temporarily banned from the server due to a port scan detection of the firewall. The ban is supposed to last one hour.

I restarted the server, so normally you should be fine again. Of course if it detects the same thing, it will ban your ip again unfortunately. Were you maybe running some kind of script or doing some mail/ftp or other access that might have been considered a port scan?
manfer
A port scan from my ip? Obviously if you say that is because you see it on the logs and that worries me because I didn't do such a thing. Can you tell me the hour?

Shouldn't be anything wrong in the account that I know but unless I have access I can't review.
Bondings
manfer wrote:
A port scan from my ip? Obviously if you say that is because you see it on the logs and that worries me because I didn't do such a thing. Can you tell me the hour?

Shouldn't be anything wrong in the account that I know but unless I have access I can't review.

I have sent you the log/deny entry by pm as it contains your ip address. It came back, so I think this was another detection.

To be honest, I'm not an expert in firewalls and port scan detection so I can only rely on that output. From my experience with the firewall is that it tends to easily block ip's (I did make it quite harder in the settings) and quite a lot of times unnecessary.

However in this case your ip was the only one (temporarily) blocked on the list and this repeatedly. It might be a good idea to scan your computer for malware. I'm not saying there is malware, just that this might be the cause if it is not the firewall blocking normal traffic.

Aug 27 13:13:24 host lfd[23371]: *Port Scan* detected from ...
Aug 27 13:48:00 host lfd[30044]: *Port Scan* detected from ...
(I found some other logs mentioning the date in normal form. The server is on CEST, by the way.)

The previous limit was 10 port accesses per 300s, I changed it to 20 port accesses (maximum) in 60 seconds. We'll see if this works or if you still are getting banned.
manfer
Thanks I'm going to investigate what that log exactly means.

I can confirm the IP was from my ISP. Well, that was obvious as I was the one blocked, it was my IP for sure.

I have just changed IP and no problem by now. But I can't understand what was going on from the other IP. Really the only port I have ever used on that server is the direct admin port, maybe I used FTP once but not today. And probably I hit some times a typo of the direct admin port, the direct admin with 3 numbers only instead of 4, or 2 numbers instead of 4. But a lot of attempts to different ports in less than 300s not for sure. The only possibility is if I had a tab in browser with the typo as I have closed and opened browser sometimes restoring session but anyway those would be requests to always the same closed port and if the firewall considers that as a port scan, I can only say "oh my god".

I have read of false positives from FTP clients but I haven't used FTP to that server today so I still can't figure out what happened.

Thanks a lot for your fast help. Regards.
Bondings
I guess as long as your ip doesn't get blocked again, we can ignore the issue. Otherwise I'll try to check the actual connection attempts.
Related topics
I cant access my forum account HERE!!!
Attn. Morpheus - Account Suspenion
Deleted public_html
Password Not Working
Still Using Internet Explorer?? Why? It's just... stupid
MySQL Masters Binary Logs & Replication?
.htaccess problem
Forwarders not working
Which is the Best Payment Gateway in Net?
Can't access site.
Web hosting accounts
Nothings Working ? Permissions -- Account Creator
leader,please make my account rework
Email Lock Out
Reply to topic    Frihost Forum Index -> Support and Web Hosting -> Web Hosting Support

FRIHOST HOME | FAQ | TOS | ABOUT US | CONTACT US | SITE MAP
© 2005-2011 Frihost, forums powered by phpBB.