[Xitami] ip blocking

[Charles Schmidling]

Robert,

You've been found!  Usually doesn't take long.

Another trick to defeat these things is change your working HTTP port from
80 to something other.  Since doing this, I've gotten ZERO DoS scans.  The
trick is to set up a CNAME for your domain and forward your web page to the
new port via this "alias".

Example:
Say I want my HTTP port to set at 450.  This is done as an offset setting in
defaults.cfg file.  Next, I set up CNAME with my DNS service (either at my
domain registrar (e.g.NetSol) or a DNS service (e.g. ZoneEdit)).  Last, I
forward
          www.mydomain.com
to
        ww2.mydomain.com:450/index.html.

and voila, no more DoS scanners.  I now only receive "legitimate" scans from
robot hunters and search engines.  And these folk are generally identifiable
in the logs.

The standard "48 to 72 hour" propagation delay will apply the first time you
do this due to the new "domain."  Forwarding changes are instantaneous.

If you use Virtual Domains, you will need to add the new ww2.mydomain.com to
your domain list.  Unless you want it to go someplace different, point it to
the same configuration file as www.mydomain.com.

Happy serving,
Charles

----- Original Message -----
From: "Schmitt Scheubel" <rss@jean.kgw.tu-berlin.de>
To: <xitami@lists.xitami.org>
Sent: Tuesday, November 30, 2004 11:30 PM
Subject: [Xitami] ip blocking


> Hi,
> can anyone tell me what i must do to block up ip-numbers.
> Reason
> last night a computer sends requests every seconds to my server over six
> hour , and I don't know what to do.
>
> greetings
> robert
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami