Bots are crashing mystic. Maybe?
When it crashes I see a research bot is on a node. Why mystic crashes at
On 11/01/16, Solarbaby pondered and said...
Bots are crashing mystic. Maybe?
When it crashes I see a research bot is on a node. Why mystic crashe
They have been crashing MIS at Agency in recent days. Not sure what they are doing when the do manage to down it but I think all nodes may be
busy and the blocked activity is running hard.. :(
Avon wrote to Solarbaby <=-
They have been crashing MIS at Agency in recent days. Not sure what
they are doing when the do manage to down it but I think all nodes may
be busy and the blocked activity is running hard.. :(
They managed to get Cyberia BBS as well, been getting BUSY from his
system a lot lately.
The bots are starting to give my Synchronet system some grief. I think I'm going to have to go down the road of using fail2ban to block the attempts of banned IPs altogether, before they hit the BBS. Let
iptables do the dirty work. :)
Avon wrote to Vk3jed <=-
I wonder if this is an area for future development for g00r00 as if
this sort of stuff keeps up I figure we could all benefit from advances
in 'smarts' to help combat it in MIS and MIS2.
The issue is such that the block really needs to happen before the connection gets to MIS/MIS2. In Linux, iptables can do the deed.
But for me, I'll be looking into fail2ban for now. I want to offload as much as possible from the BBSs as possible. I have hardly any users, 4
or 5 lines and I can't get on half the time because of ghosts. :(
Avon wrote to Vk3jed <=-
Is this a linux only tool I suspect. I'll need to find a windows equivalent me thinks.
Avon wrote to Vk3jed <=-
Is this a linux only tool I suspect. I'll need to find a windows equivalent me thinks.
Yep. :)
Avon wrote to vk3jed <=-
Perhaps easier said than done... will dig around...
On 11/01/16, Pequito pondered and said...
They managed to get Cyberia BBS as well, been getting BUSY from his system a lot lately.
fsxNet HUB took a hit today but as it does not run Telnet I can not be sure what caused the outage. I posted the logs over in the general chat echo.. Humm....
On 11/02/16, Vk3jed pondered and said...
The bots are starting to give my Synchronet system some grief. I thi I'm going to have to go down the road of using fail2ban to block the attempts of banned IPs altogether, before they hit the BBS. Let iptables do the dirty work. :)
I wonder if this is an area for future development for g00r00 as if this sort of stuff keeps up I figure we could all benefit from advances in 'smarts' to help combat it in MIS and MIS2.
On 11/02/16, Vk3jed pondered and said...
Avon wrote to Vk3jed <=-
Is this a linux only tool I suspect. I'll need to find a windows equivalent me thinks.
Yep. :)
Perhaps easier said than done... will dig around...*hands Paul a Linux CD* :P
Quoting Vk3jed to Avon <=-
The bots are starting to give my Synchronet system some grief. I
think I'm going to have to go down the road of using fail2ban to block
the attempts of banned IPs altogether, before they hit the BBS. Let iptables do the dirty work. :)
On 11/02/16, Avon said the following...
On 11/01/16, Solarbaby pondered and said...
Bots are crashing mystic. Maybe?
When it crashes I see a research bot is on a node. Why mystic c
They have been crashing MIS at Agency in recent days. Not sure what t are doing when the do manage to down it but I think all nodes may be busy and the blocked activity is running hard.. :(
They managed to get Cyberia BBS as well, been getting BUSY from his
system a lot lately.
Avon wrote to Vk3jed <=-
I wonder if this is an area for future development for g00r00 as if this sort of stuff keeps up I figure we could all benefit from advanc in 'smarts' to help combat it in MIS and MIS2.
The issue is such that the block really needs to happen before the connection gets to MIS/MIS2. In Linux, iptables can do the deed. Windows, I don't know (haven't run a Windows server for donkeys years, especially one exposed on the Internet). :)
Richard Menedetter wrote to Tony Langdon <=-
Perhaps easier said than done... will dig around...*hands Paul a Linux CD* :P
Tony ... you have beaten me to it.
But better you do it, postage is so high when sending it from here ;)))
Tiny wrote to Vk3jed <=-
I'm thinking there is a way to do that stuff in the router with
DD-WRT. I'm going to have to get off my ass and look into that one day.
;) Especialy as I bought the damn router specifically for features like that.
Gryphon wrote to Vk3jed <=-
There was a time when I was adding blocked IPs to IPTABLES on a regular basis. What started happening was that IPTABLES would take several minutes to load and refresh because I had so many blocked IPs. It
almost became worthless at that point. That when I stopped adding
blocked IP and just let Mystic do the blocking. The only thing I block
is SSH and I leave a whole in it so that I can ssh in from my local network, and from my work network. Beyond that, nobody can connect via ssh.
Tiny wrote to Vk3jed <=-
I'm thinking there is a way to do that stuff in the router with DD-WRT. I'm going to have to get off my ass and look into that one da ;) Especialy as I bought the damn router specifically for features li that.
Hmm, then the router has to be able to tell what is valid and invalid traffic. Or be told by the systems behind it (this would be doable for Linux based routers that you can load your own scripts and software on to).
On 11/01/16, Pequito said the following...
On 11/02/16, Avon said the following...
On 11/01/16, Solarbaby pondered and said...
Bots are crashing mystic. Maybe?
When it crashes I see a research bot is on a node. Why mys
They have been crashing MIS at Agency in recent days. Not sure w are doing when the do manage to down it but I think all nodes ma busy and the blocked activity is running hard.. :(
They managed to get Cyberia BBS as well, been getting BUSY from his system a lot lately.
Yeah, I've noticed that too. I get a busy signal once in a while and I have to SSH in to the command line and clear the nodes. I'm wondering
why MIS/Mystic isn't killing the nodes ones the timeout has been
reached. If Mystic would kill the nodes once timeout was reached, I wouldn't be having this problem.
karl wrote to Vk3jed <=-
This would be fairly easy to accomplish with fail2ban. I think I
looked to see if this could be incorporated into dd-wrt but dont
remember what I found. Fail2ban also lets you add rules to the firewall whic can automatically be removed after a configurable period of no attacks.
Quoting Vk3jed to Tiny <=-
Hmm, then the router has to be able to tell what is valid and invalid traffic. Or be told by the systems behind it (this would be doable for Linux based routers that you can load your own scripts and software on to).
Bots are crashing mystic. Maybe?
When it crashes I see a research bot is on a node. Why mystic crashes at 100% cpu and continues to use 100% cpu indefinitely puzzles me a lot.
I'm going to have to write a script to keep my device from burning
itself up. Did anyone already write something that they would like to share?
--- Mystic BBS v1.12 A29 (Raspberry Pi)
* Origin: Solar BBS (21:1/151)
They have been crashing MIS at Agency in recent days. Not sure what they are doing when the do manage to down it but I think all nodes may be
busy and the blocked activity is running hard.. :(
Best, Paul
--- Mystic BBS v1.12 A31 (Windows)
* Origin: Agency BBS | telnet://agency.bbs.geek.nz (21:1/101)
There was a time when I was adding blocked IPs to IPTABLES on a regular basis. What started happening was that IPTABLES would take several minutes to load and refresh because I had so many blocked IPs. It
almost became worthless at that point. That when I stopped adding
blocked IP and just let Mystic do the blocking. The only thing I block
is SSH and I leave a whole in it so that I can ssh in from my local network, and from my work network. Beyond that, nobody can connect via ssh.
Tiny wrote to Vk3jed <=-
DD-WRT allows that... it's the most complex thing I've ever used. hahaha. I'm going to try to get that working and let you all know how I make out.
bots). Try Solarbaby's script first to try and kill off possible 'bad' tasks.
I'd say set the Pi up as a front end like some others have done. Mine isn't really having that much trouble rejecting the bots. Try it as a front end like others have done. It might stop the 100% cpu usage and after getting it tweaked to work well would make a good video and wiki entry.
Gryphon wrote to Vk3jed <=-
There was a time when I was adding blocked IPs to IPTABLES on a regul basis. What started happening was that IPTABLES would take several minutes to load and refresh because I had so many blocked IPs. It almost became worthless at that point. That when I stopped adding blocked IP and just let Mystic do the blocking. The only thing I blo is SSH and I leave a whole in it so that I can ssh in from my local network, and from my work network. Beyond that, nobody can connect vi ssh.
That is an interesting point. I wonder how many of those IPs in the
block list are actively probing at any given time. Some must be dynamic IPs that change from time to time, in which case, temporary bans might reduce the size of the list.
On 11/02/16, Gryphon said the following...
On 11/01/16, Pequito said the following...
On 11/02/16, Avon said the following...
On 11/01/16, Solarbaby pondered and said...
Bots are crashing mystic. Maybe?
When it crashes I see a research bot is on a node. Wh
They have been crashing MIS at Agency in recent days. Not s are doing when the do manage to down it but I think all nod busy and the blocked activity is running hard.. :(
They managed to get Cyberia BBS as well, been getting BUSY from system a lot lately.
Yeah, I've noticed that too. I get a busy signal once in a while and have to SSH in to the command line and clear the nodes. I'm wonderin why MIS/Mystic isn't killing the nodes ones the timeout has been reached. If Mystic would kill the nodes once timeout was reached, I wouldn't be having this problem.
Maybe lower the timeout to 2-3 minutes? Should be enough for new users
to create a new account and others to login before a timeout is reached.
I tried that once. The timeout isn't only for the logon process; it's
for any inactive timeout. So 2-3 minutes of inactivity and a user gets booted. I had set it to 2 minutes ones and I started getting complaints that the bbs would drop people.
Gryphon wrote to Vk3jed <=-
I wonder if they are the are IP's that keep changing, or if it is just
a compromised device that has been zombified to start doing the same attacks that compromised it.
On 11/03/16, Gryphon pondered and said...
I tried that once. The timeout isn't only for the logon process; it' for any inactive timeout. So 2-3 minutes of inactivity and a user ge booted. I had set it to 2 minutes ones and I started getting complain that the bbs would drop people.
There is a separate setting for login time vs timeout for inactivity ... or am I misunderstanding you? :)
Quoting Vk3jed to Tiny <=-
hahaha. I'm going to try to get that working and let you all know how I make out.
Good luck. :)
To that end, I have written a new script that will kill all duplicate mystic processes if there are more than 2 with the same -IP<IPADDRESS>. It will also check to see if the IP is in the goodip.txt file and if it kills the process, it will add the IP to the badip.txt.
Tiny wrote to vk3jed <=-
Thanks. Found some interesting websites about it, so I'm quite sure
it can be done. Just need to find time when I don't have anything else
on the go to do it.
On 11/02/16, bcw142 pondered and said...
I'd say set the Pi up as a front end like some others have done. Mine
Yes.. but is it really (for want of a better way of describing it) best practice to suggest this to everyone as the 'solution' I am not sure it is.
--- Mystic BBS v1.12 A31 (Windows)
* Origin: Agency BBS | telnet://agency.bbs.geek.nz (21:1/101)
I doubt there is a 'solution', just various things that help keep the
BBS up and running ;(
Hi Bcw142!The botnets and the massive DDoS attacks. I suspect one took down FSXNet last night, which caused fidopoll to hang on my system. Oddly retronet also
I doubt there is a 'solution', just various things that help keep the BBS up and running ;(
What is the actual problem??
Any daemon connected to the Internet should be able to cope with scans.Basic scans I don't even notice.
Or do you guys see massive denial of service attachs with at least multiple megabits of constant traffic coming from wildly distributed IPs?That's It! We need to be able to clean the stuff 'they' infected to cut the attacks or put many firewalls throughout the internet to filter them out.
Any daemon connected to the Internet should be able to cope with scans.
Or do you guys see massive denial of service attachs with atThat's It! We need to be able to clean the stuff 'they' infected to
least multiple megabits of constant traffic coming from wildly
distributed IPs?
cut the attacks or put many firewalls throughout the internet to
filter them out.
Any daemon connected to the Internet should be able to cope withIt should, but it seems mystic doesn't.
scans.
Probably the biggest problem with mystic (and Magicka, and probably others) is that they assign node numbers before authentication.
Also, keep in mind that many people running BBSes are doing so on
their home connections, which are already limited bandwith, so it
doesn't take so much traffic to soak it all up.
But yeah, it would seem there are stability problems with Mystic under some circumstances as we have seen with the agency hub crashing. It's
not open source and gooroo is away, so no one can fix them, so it's
about trying to work around it.
Same is true with QWK where Mystic (at least the recent beta) generates duplicate MSGIDs.
It's not just QWK, the bot posts are generating duplicate msgids.
Enigma throws out the duplicates, and I've noticed particularly when necromaster posts his necronomicon and retronet adds
Anyway. I hope it gets fixed some time..
It's not just QWK, the bot posts are generating duplicate msgids. Enigma throws out the duplicates, and I've noticed particularly when
necromaster posts his necronomicon and retronet adds, the retronet one gets tossed out because it's the same as the necronomicon one. Same with idbbs and pinet ads.
My theory (I'm not sure if I said before) is it uses timestamps to generate MSGIDs, so when more than one message is generated in a second, it shares message ids.
It's not just QWK, the bot posts are generating duplicate msgids. Enigma throws out the duplicates, and I've noticed particularly when
necromaster posts his necronomicon and retronet adds, the retronet one gets tossed out because it's the same as the necronomicon one. Same with idbbs and pinet ads.
Hmmm.. interesting.. I've never experienced that before.. I'll have to pay closer attention to the kludge lines and see if anything really is getting double tossed
| Sysop: | sneaky |
|---|---|
| Location: | Ashburton,NZ |
| Users: | 31 |
| Nodes: | 8 (1 / 7) |
| Uptime: | 226:58:32 |
| Calls: | 2,088 |
| Calls today: | 2 |
| Files: | 11,140 |
| Messages: | 948,461 |