Whenever you end-up with a large number of banned IP's in fail2ban you might want to know if there are multiple IP's banned from the same subnet. This scripts groups all banned IP's into /24 subnets.
By default the script returns all subnets with 10 or more IP's banned by fail2ban. You can change the group size either by adapting this script or using the --groupsize= parameter.
Example:
sudo ./fail2ban_subnets.sh --groupsize=15
I think I have a setting problem with Fail2ban apache-badbot filter because I unfortunately have attacks of this type, and Fail2ban does not ban any IP. //
failregex = ^<HOST> -[^"]*"(?:GET|POST|HEAD) \/.* HTTP\/\d(?:\.\d+)" \d+ \d+ "[^"]*" "[^"]*(?:%(badbots)s|%(badbotscustom)s)[^"]*"$
Fail2ban has a build-in tool for testing the fail2ban filters, called fail2ban-regex, which you can use via command line. Like:
fail2ban-regex /var/www/vhosts/<your domain>/logs/access_ssl_log /etc/fail2ban/filter.d/apache-badbots.confOnce you're happy with the matched results, then use the following (replacing the last value with the name of your jail) to commit the changes without having to restart the Fail2Ban service:
fail2ban-client reload nameofyourjail
One of the most effective ways to boost performance is by optimizing PHP settings and PHP-FPM in Plesk. This comprehensive guide provides a step-by-step tutorial to help you fine-tune your server configuration, resulting in faster loading times, improved resource utilization, and a better user experience. Let’s dive in and unlock the full potential of your Plesk server!
The server receives a large number of requests, which leads to the PHP-FPM pm.max_children limit being reached by the website(s). This usually indicates that the server is under attack or that the number of website(s) visitors has increased sharply. Attacks or increased visitor traffic put a strain on the server's CPU, as PHP handlers that execute code begin to use the CPU more actively to process incoming requests.
Resolution
How to monitor and analyze the usage of system resources (CPU, Memory, Disk) in a period of time using atop?
How to calculate pm.max_children value on a Plesk server?
The following Plesk Obsidian solutions and 3rd-party extensions help to mitigate DDoS attacks:
How to diagnose a DoS/DDoS attack and find websites under attack on a Plesk server?
A website on a shared hosting can consume all system resources and disrupt the performance of other websites. This issue is known as the “noisy neighbor problem”. Plesk Cgroups Manager is an extension that helps you address this issue by managing the consumption of the CPU, RAM, and disk read and write bandwidth by customers.
In this topic, you will learn how to install and configure the Plesk Cgroups Manager extension, and also how to use it to monitor and control resource consumption by customers.
Some server operators find themselves battling with a high CPU load on their systems, which inevitably slows down website responses.
The main cause of high CPU loads is often due to search engine crawlers and “bad bots”, which are essentially crawlers similar to search engines but do not serve any purpose for you. What bad bots do with the crawled data remains a mystery. //
If you want to observe the 20 processes that continuously place the highest load on a server live, you can do this with a watch command line command:
watch "ps aux | sort -nrk 3,3 | head -n 20"Sometimes slow database processes or a high number of them can slow down database transactions. Let’s extend the watch with an extra section that displays the current database processes, too:
MYSQL_PWD=`cat /etc/psa/.psa.shadow` watch "ps aux | sort -nrk 3,3 | head -n 20 && echo "\ " && mysqladmin proc status -u admin"Fail2ban has a build-in tool for testing the fail2ban filters, called fail2ban-regex, which you can use via command line. Like:
fail2ban-regex /var/www/vhosts/<your domain>/logs/access_ssl_log /etc/fail2ban/filter.d/apache-badbots.confWhich uses the /var/www/vhosts/<your domain>/logs/access_ssl_log log as a source to test the Apache Bad bots filter located at /etc/fail2ban/filter.d/apache-badbots.conf. (Replace <your domain> with a domain on the server).
If you want to change/improve your fail2ban filters I higly recommend this blog post by @Peter Debik.
How to Avoid High CPU Load & Block Bad Bots with Plesk - Plesk
This tutorial will focus on setting up a Postfix SMTP server to use Dovecot SASL for user authentication. As Dovecot provides mechanisms for user authentication, Postfix will simply ask Dovecot to do the work for it. That way, there is no need to re-invent the wheel.
Make a note of the Plesk License Key: Tools & Settings -> [Plesk] License Information
Installing Plesk
To install Plesk with the default configuration, follow these steps:
- Log in to the desired server with the root user account.
- To install Plesk, enter the following command:
sh <(curl https://autoinstall.plesk.com/one-click-installer || wget -O - https://autoinstall.plesk.com/one-click-installer) - After entering the command, the latest stable Plesk version will be downloaded. This will be installed along with the standard components and features. In addition, all available patches and updates will be installed. The installation may take some time.
- Afterwards, you can add or remove additional Plesk components if necessary.
If you have purchased a Plesk license from one of Plesk partners, technical support should be provided by them. Plesk partners are fully trained and deliver best-in-the-industry support for Plesk products running on their infrastructure.
However, if you would like to get support directly from Plesk, you may purchase the Plesk support subscription.
Plesk support subscription terms
Support subscription purchase is available for two Plesk Obsidian latest releases only, please refer to Change Log for Plesk Obsidian.
Subscription has a free trial period for 1 month. If you order Plesk support subscription for a license for the first time, then you will be charged $0 for the first month and $10 for each next month.
In this tutorial we are going to install Plesk Web Admin SE Control Panel on Vultr VPS. This allows you to create 3 websites and unlimited sub-domains completely for free on per VPS instance. This free offer is limited to some VPS providers only, for other VPS providers which are not supported you will have to buy Plesk Control Panel license. So it is recommended to use Vultr VPS which offers really great performance at affordable price.
To generate a Wildcard certificate, I found the way to do it is by adding an NS type record for _acme-challenge.domain pointing to the domain, and this way it takes the TXT record from Plesk.
Host Type Record Value
_acme-challenge NS yourdomain.com
In the latest Plesk Obsidian 18.0.58 we have released our new tool to upgrade MariaDB to a supported LTS branch from Plesk UI.
To upgrade your MariaDB server without this tool you need to execute a lot of steps in SSH terminal on the source and destination version of the MariaDB server.
Our tool checks configuration, performs DB backup, configures MariaDB package repositories, performs the upgrade, and runs necessary post-upgrade actions.
Currently, this function is in the public Beta stage, and would like to ask you to try it and send us your feedback.
To enable the feature, add the following lines to the panel.ini file. You can do it using the command line or our Panel Ini Editor Extension
[databaseManagement]
features.canBeUpgraded = 1
==> "Upgrade Now" will be available on "Tools & Settings -> Database Servers" page.
After the upgrade please fill out our very short feedback form: MariaDB upgrade by Plesk
We recommend that you use the current long-term support (LTS) version of the MariaDB database for your Plesk server.
An old version of the database server poses a risk because, in this case, the server’s web applications use the old version as well. New versions of MariaDB are more stable, secure, efficient, and have more useful features compared to old versions.
In the Plesk interface, you can upgrade your MariaDB database server to the current long-term support (LTS) version.
I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly.
First, find the right jail to unban for. Use:
fail2ban-client status to get the actual jail names. Then, use this to find the iptables rule name:
iptables -L -nThe rule name and jail name may not be the same but it should be clear which one is related to which.
fail2ban-client set <jail-name> unbanip <ip-address>ow to prevent cleartext / plaintext authentication via IMAP/POP3 and SMTP in Postfix on Plesk server?