From jonathan at jabwebsolutions.co.uk Fri Sep 8 09:54:58 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] IP Transit Connection Message-ID: <45012FE2.4070905@jabwebsolutions.co.uk> ** IP Transit Connection The IP Transit connection to IFL1/2 is down and as such, our servers are unavailable. We are investigating and will let you know as soon as we know anything. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Fri Sep 8 10:02:34 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] Improving Web Server Security Message-ID: <450131AA.8090302@jabwebsolutions.co.uk> ** Improving Web Server Security After a spate of attacks and attempted attacks on some of our servers over the last few weeks, we have re-assessed some of the security measures with the aim of preventing future occurrences. The result of this assessment has been the addition of two new modules within the Apache web service. The first module is mod_evasive, which we will use to help monitor for and reject DoS (Denial of Service) attacks. The second, and main addition, is mod_security. This is a rules-based access-control system which will monitor all incoming requests and deny those that may prelude a possible attack on a site/server. ** mod_evasive This module monitors connections for possible spurious request. If another computer requests a large number of files very quickly over an one connection, or makes a rapid number of new connections to one or more pages in a very short time (to try and overload the server) they'll be blacklisted temporarily. Any further requests while blacklisted will be denied, helping the foil an attack and prevent the load on the server from spiraling out of control. However, it will not prevent access to a surge in genuine traffic (which can still overload the server) - only traffic generated very quickly from one or more IP addresses will be blocked. ** mod_security As a rules-based access-control system, mod_security monitors every request and tests it against a number of rules pre-set by us. If the request matches any rule it will be considered as the prelude of an attack and denied access, therefore stopping it in it's tracks. For example, all systems use the null-byte (a character which has a value of 0 for a computer) as a special character to tell them when they reach the end of a string. You can pass this on a URL as '%00' and as such can be used to confuse some programs and scripts. As there is no need to pass a null-byte within any URL string it can only be used as part of an attack. Therefore, by setting a rule which matches against this we can stop the attack before it starts. ** Timescale Unfortunately, some genuine scripts can use the same techniques in a genuine request as an attacker would use to compromise another script. Therefore we will need to work on the configuration in order to minimize any possible false-positive matches on requests which could subsequently disable a website. Over the next week-or-so, we will activate the module on the server gamma.jabservers.co.uk and set it to work passively. It will monitor the connections and report those that match the rules we have configured, but never refuse a request. This will allow us to adjust the rules as they match current requests and potentially minimize errors one it does over live. However, as there is a risk some sites will be affected by the eventual full activation of both modules regardless, we will also be staging the roll out across the servers. Through staging the roll our, we can prevent our Support Team from being over-loaded with issues and therefore make sure we can deal with any problems that may arise more efficiently. We will also be releasing a series of Knowledgebase articles which will cover common topics and solutions to some of the problems you may come across once it is enabled. However, we will still assist you with any problem you may via the usual methods. Full details about the changes and timescale will be released next week or so. However, if you have any questions or concerns about this in the mean time, please don't hesitate to contact us. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Fri Sep 8 10:42:47 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] IFL2 Issue Message-ID: <45013B17.4060804@jabwebsolutions.co.uk> ** IFL2 Issue We have had an update and the issue is more general within the IFL2 data-center. There is a situation/issue over parts of the network causing dropped connections and/or high packet-loss. They are in the process of sourcing the error at the moment and will update us as soon as possible. We will also keep you up-to-date as we know anything more. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Fri Sep 8 10:52:43 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] IFL2 Issue (Resolved) Message-ID: <45013D6B.8000006@jabwebsolutions.co.uk> ** IFL2 Issues (Resolved) At approx. 9:35 this morning a situation within IFL2 arose which caused the majority of networks within the said data-center to fail, or receive high-levels of packet loss over an available connection. As a result, our connection failed resulting in the loss of service to all customers/visitors on the relevant servers. Within the last few minutes this has been restored and all services should again return to normal, although all incoming e-mails queued at remote servers may take a few hours to be delivered. We apologize for any inconvenience that this issue may have cause. As a short aside, we are finalizing the agreement and time-table for the transfer of our IP transit contract to another, more reliable, provider. Details about these changes, the process and the time-table for the change will be released next week. If you have any questions regarding this or any other problem, please contact us. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Fri Sep 8 13:48:51 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] IFL2 Issue (Resolved) Message-ID: <450166B3.20801@jabwebsolutions.co.uk> ** IFL2 Issues (Update) We have had a report back from IFL regarding this mornings situation and after an investigation at the time, it was deemed that a 'broadcast storm' caused the network outage by overloading it. A broadcast storm is a networking situation where a computer or node sends out a broadcast message to all local nodes, which prompts it to respond by broadcasting it's own message onto the network. This in turn prompts further responses, and so on and so on. This is a snowball effect and normally has a series negative impact on network performance: In this case, complete saturation of parts of the network. Once the culprit was found, the related port was shut down and the network quickly returned to normal operation. If you have any questions regarding this or any other problem, please contact us. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Wed Sep 13 15:58:54 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] IP Transit Issue Message-ID: <45081CAE.4040703@jabwebsolutions.co.uk> ** IP Transit Issue Once again our IP transit connection has failed without notice. We are investigating and will of course update you as and when we know anything more. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3289 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.jabwebsolutions.co.uk/pipermail/support-list/attachments/20060913/cfef3c2e/smime.bin From jonathan at jabwebsolutions.co.uk Wed Sep 13 17:42:55 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] IP Transit Issue (Resolved) Message-ID: <4508350F.1080204@jabwebsolutions.co.uk> ** IP Transit Issue (Resolved) The IP transit issue that affected some of our customers this afternoon has been resolved and all services should have returned to normal. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Tue Sep 19 00:40:51 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] Enabling ModSecurity Message-ID: <450F2E83.3060806@jabwebsolutions.co.uk> ** Enabling ModSecurity With over a week of testing and tuning it's configuration, we are ready to begin the staged enabling of ModSecurity across all our servers over the coming weeks. As explained in our previous article, ModSecurity is a rule-based access control layer within the Apache web server, which can be used to monitor all requests for those that are attacks (like the injection-based Spam attack) or are precursors to more serious attacks. Just as SpamAssassin, our Spam filtering software, has a set of rules used to test e-mails to see if they have elements common to known Spam e-mails (such as using the word viagra or even v1agra), ModSecurity has a set of rules which test requests to see if they are trying to exploit loopholes, run commands or do something that they generally shouldn't. But, like SpamAssassin, there is a risk it can falsely label a legitimate request as an attempted attack (also known as a false-positive). This is the reason behind the period of testing and tuning over the last week - our attempt to minimise the chances of false-positives occurring once the system is fully enabled. ** Rollout Timeable As there is a risk of false-positives, resulting in parts of some websites being blocked with a 500 error (also known as Server Configuration Error), we are going to stage the roll out, enabling ModSecurity on one server at a time over the next five weeks. The first server to have ModSecurity fully-enabled will be the server, gamma.jabservers.co.uk, on the 24th September (this coming Sunday) between 02:00 and 04:00. The remaining servers will be enabled one at a time with a week's break in-between (with prior notification given for each server): - 24/09/2006: gamma.jabservers.co.uk - 01/10/2006: beta.jabservers.co.uk - 08/10/2006: alpha.jabservers.co.uk - 15/10/2006: mxserver.org - 22/10/2006: mxlinux.com ** Support Also over the next week we will add a number of related articles to our Knowledgebase which will go into more detail about how ModSecurity works, the rules we have enabled on the servers and how to amend settings on your domain if you are experiencing problems. However, once enabled, if you believe that you are experiencing any related problems, please Submit a Ticket to our Support Team (with details on how you produced the issue, such as the page you are accessing and the values you are entering on the page), and we will look into it, working with you to resolve it as quickly as possible. Thank you for your understanding in this matter - we are committed to providing the best in service and support for our customers. Through this addition we hope to improve the security of all our customers websites as well as the servers in general. If you have any further questions, please don't hesitate to contact us at any time. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Thu Sep 21 15:21:01 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] Periodic Connection Issues to IFL2 Message-ID: <45129FCD.2050609@jabwebsolutions.co.uk> ** Periodic Connections Issues to IFL2 We seam to be experiencing small, intermittent, periods on connection downtime, possibly caused by incorrect routing of traffic over the transit connection. We are investigating and will update you as soon as we can. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Sat Sep 23 13:05:54 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] Periodic Connection Issues to IFL2 Message-ID: <45152322.4060102@jabwebsolutions.co.uk> ** Periodic Connection Issues to IFL2 The connection issues currently being experienced with our Manchester-based servers is re-occurring and it due to a routing issue on the Manchester-London link - data is being sent back and forth along the connection, never reaching it's destination. We are pushing for an update from our Transit provider and we will, as always, let you know as soon as anything changes. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3289 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.jabwebsolutions.co.uk/pipermail/support-list/attachments/20060923/5b5928f8/smime.bin From jonathan at jabwebsolutions.co.uk Sat Sep 23 16:05:30 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] Periodic Connection Issues to IFL2 Message-ID: <45154D3A.5010203@jabwebsolutions.co.uk> ** Periodic Connection Issues to IFL2 Having contacted the transit provider, they believe it issue is due to a faulty switch. An engineer is on-site, working towards a solution, however we/they have no idea as to when the situation will be resolved. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/ From jonathan at jabwebsolutions.co.uk Sat Sep 23 17:54:05 2006 From: jonathan at jabwebsolutions.co.uk (Jonathan Wright) Date: Mon Nov 19 03:48:43 2007 Subject: [jab-support] Periodic Connection Issues to IFL2 Message-ID: <451566AD.4030003@jabwebsolutions.co.uk> ** Periodic Connection Issues to IFL2 Due to circumstances beyond our control, our transit provider, C4L, has experiencing problems with traffic routing within their network. This situation should now be resolved and all services returned to normal. We will attempt to keep everyone as updated as possible on the situation should there be any further problems. Please accept our sincere apologies for any inconvenience that this may cause you ? we are endevouring to speed up the transition to our new network providers. We are still awaiting a few details from them and we will release an announcement regarding this change. -- Jonathan Wright -- Maintenance and Technical Director -- Keep up to date with all our latest news and information: Mailing Lists (http://www.jabwebsolutions.co.uk/lists) News RSS Feed (http://www.jabwebsolutions.co.uk/rss) -- Freephone: 0800 043 0 153 Fax: 0870 622 0 158 Direct: 02920 00 64 94 -- JAB Web Solutions Limited Suite 145 61 Wellfield Road Roath, Cardiff Mid-Glamorgan CF24 3DG -- This email and any files transmitted with it are confidential and intended solely for the above addressee. If you are not the named addressee you should not disseminate, distribute, copy or alter this email in any way or any form. Any views or opinions presented in this email are solely those of the author and might not represent those of JAB Web Solutions. Should any issue arise from this correspondence, contact the author for further details. Although JAB Web Solutions has taken reasonable precautions to ensure no viruses are present in this email, the company cannot accept responsibility for any loss or damage arising from the use of this email or attachments. -- Company Number: 5191094 VAT Number: 840666814 -- http://www.jabwebsolutions.co.uk/