No update since yesterday, but problems still bad. Help?
It is not crawling most of the time, but it does occasionally like just in the last 10 to 15 minutes get hit with a wave of attacks. We are moving some people off that want off, the main shared IP seems to be the target, it is not just hitting a domain like normal 
i was good through the night I checked it multiple times then.
What is so weird on it is when it is slow, there is almost no cpu or ram usage, just overwhelmed with the amount of requests at one time makes the iis queue go extreme.
I think the problem is that you have taken off your poncho. You are exposed to all the nasty stuff being thrown at you.
…but seriously, moving everyone off and eventually abandoning the server is not a solution. What if another server is hit? Is there a strategy forming?
jph,
We are working on it, IIS 7.5 would be great, as it has a lot better request filtering. I can’t post this publicly but IIS 6 has some NASTY NASTY issues with processing POST requests (which many of these are) into the engine even if the file is deleted, prohibited etc, IIS7.5 has far better pipeline and request filtering controls that kill these nasty issues. I’ve seen these POST request ‘bugs’ prior but nothing as sustained as this attack.
I am really looking forward to getting 2008 R2 on both clusters, we’ll be announcing the Cluster1 update for hsphere soon that enables it, maybe even next weekend.
We are also working on a transparent filtering engine if required but this isn’t something we can just throw on now.
BTw my ‘poncho’ came off when I left Miami/Florida living, I never really wore one at all but I did have one in the glovebox 
Something bad is going on right now. Pages failing on multiple domains. Some php, some simple html. Even cp slow or not fully loading some pages for accounts on this server.
I have not seen any issue last more than 5 minutes on it in days now. Did it self resolve quickly?
Checking a client site now (on win17)…
[SIZE=6][FONT=Helvetica]This webpage is not available[/FONT][/SIZE]
And from my email…
To: Me, the jodo reseller
From: My customer
[FONT=arial][FONT=Calibri]Yes, something is wrong, we don’t know what. I’m CCing my IT guy again here.[/FONT][/FONT]
[FONT=arial][FONT=Calibri] [/FONT][/FONT]
[FONT=arial][FONT=Tahoma]From:[/FONT][FONT=Tahoma] My client’s customer
Sent: Friday, October 19, 2012 11:03 AM
To: My client
Subject: web etc
Importance: High[/FONT][/FONT]
[FONT=arial] [/FONT]
[FONT=arial][FONT=Verdana]K,[/FONT][/FONT]
[FONT=arial] [/FONT]
[FONT=Verdana][snip - unrelated][/FONT][FONT=arial] [/FONT]
[FONT=arial] [/FONT]
[FONT=Verdana]your website works but is SLOW…TAKE forever to boot up[/FONT]
Can we move it to another server? I am not trying to be a pain but there is still an attack ON THE SHARED IP that is making buffers full, and then it crashes IIS to a DEP warning and this is when you see the slowness. It does not happen for long or often now, but it does happen a couple times a day.
It is a two pronged this, spam and then it seems to crash with attempted buffer overlfows that make IIS reset, or possibly even a failing exploit attempt that windows prevents (by killing IIS process off)
By Tuesday we will have a 2008 R2 server up as well, no asp.net 1.1 on it, but 2.0-4.5 and up to MVC4 as well.
This particular client is already planning to move to another server (linux) during his transition to a wordpress-based site. That always seems around the corner (within a week or so) but drags on. Meantime he is complaining about the “old” site. I don’t want to complicate/break stuff on the existing site by moving it when we should be able to simply abandon it “soon”.
I’d like to move other sites that are on the server, but various “details” make me hesitate… php issues, databases, cron jobs (being performed by a linux server, servicing a script on this server, for example). I am trying to prioritize and maybe move some myself by just creating linux accounts and testing before assigning the true domain names, but it is not something I have a lot of time for. When YOU migrate a site, are the mail services for that account affected?
related question… if I have a database associated with an account now, I know I can access that db from a (new copy of the) site on a different server, no problem. But… what if after I migrate the WEB portion of a site to another account and server, and then eventually want to delete the old account. How do I retain the database? Or do I have to migrate the database to a new copy that is “owned” by the new account?
And finally, I have to sort of repeat myself… I understand the relentless nature of the problem you are having… but it still doesn’t sound like you have more than a “stick more fingers in the dyke” approach to resolving it, and that scares me. I think you should view this as not only a problem, but a foreshadowing of what could happen worse and on more servers. You should consider any effective solution, even if that may be costly in the short term but will save you countless more hours of ongoing fire-fighting, and maybe help you retain your customers.
Why move to a linux platform for wordpress? 2008 R2 runs amazing with PHP in fastcgi
when we do a migration mail is never touched, but we can’t move platforms on it, only windows to windows linux to linux.
As for DB question, the DB will have to be backup taken, new DB made, and restored.
The solution honestly is what is being presented, MS is not doing active hotfixes for 2003, moving to a supported 2008 R2 platform IS THE answer right now, especially with the DEP error being created, and the fact that is a buffer overflow making that come in, it could well be an attack with an attempt to hack, being stopped by the windows DEP NX bit protections. This is how many old exploits happened and sometimes in attacking old becomes new again.
If this was anything but the shared IP I’d have removed the IP from live, taking a site offline for a bit in the process, but a single site, and we’d have worked with them to put it behind cloudflare or something along these lines promptly to filter the crap.
one of my clients ran their domain through “saferpage dot com” which supposedly analyzes a server for security issues. given your situation, one note popped out to me:
“[SIZE=10px][FONT=arial]The server transmit the versionnumber of the used serversoftware. Please hide the hints, to provide informations against potential attackers.[/FONT][/SIZE]”
While it is probably too late to help poor ol’ Win17 (and ticket responses now make it sound like you truly are just giving up and abandoning the whole server instead of finding some patch or upgrade to do)… you may want to look at this issue on other servers which may publish the Apache or IIS or other version info too readily. I know a random attack could still latch on to vulnerabilities, why make it easy?
whatever the story of this server, since it still sucks ass, I am trying to move a domain to another server.
I attempted to delete the domain alias from the account on Win17. The CP took a long time to confirm the deleion, but it did eventually say it was deleted, and now the domain does not show up in the list of aliases where it had been before.
I then went to a new account (on a linux machine) and attempted to assing the domain alias to a domain that is set up over there. The CP gives the error:
[SIZE=4][FONT=Times New Roman][FONT=Verdana]Domain name xxxx.com already taken.[/FONT][/FONT][/SIZE]
The domain name was apparently not properly deleted or freed from all lists in the hsphere world, and now the domain is in some kind of limbo, and I am screwed. I have submitted a ticket. Just thought I would vent here, since nobody seems to care anymore that Win17 is retarded, and people keep claiming that it is a simple fix… just go ahead and move your domain! Yeah, great idea.
Hello,
If this was a ‘simple fix’ it would have been fixed moments after it started.
There is a botnet that is attacking this shared IP even to today, and that is with over 20 accounts moved off the server, the server has almost NO LOAD on it, and still IIS is going slow at times due to the massive requests.
I don’t know here, did we recommend you delete a domain at all? I don’t see it here, we have said we can move yes, and generally their isn’t an issue in removing a domain, but sometimes Hsphere can ghost domains when they are deleted and it seems this happened here.
Now, about the version numbers, no that can’t be changed or suppressed in any viable way, and isn’t a security issue itself.
I didn’t mean to say that there was some “simple fix” for all of Win17… I was saying that the only fix offered has been to move off of it. I did not want you to move this particular domain, because it was switching to all new content and a new platform anyway, so I was moving the domain alias myself. Just as a happy coincidence, Win17 will not seem to let me loose from it’s cold, festering, dead hand.
If you can even send me a private message about the domain for which you are getting this error “already taken.” i can fix it for you, or if you can open the ticket with the domain name details that will be fine as well. The things i will need is
- Previous Account name where the domain was.
- New Account name where you want to add this.
- The domain name.
btw… thanks for the offer, Pratik. I already had a ticket submitted with that info, and it was resolved by the time I saw your post here.
virtually stopped again right now (last 15 minutes or so).
It has been coming up well here and no load on the server at all over this time period. You will need to PM me any specific URL you are seeing an issue, this may be something different, there’s not been much issue serverwide lately
I can see that one app pool was crashing some in the last 1 hour or so, let me know your domain via PM/conversation and I will check the logs of it and move out of that one and see if it helps.