Brute Force Warning : Executed actions: /etc/apf/apf -d at

[isputra]

Hi,

Yesterday i have mail from BFD/APF with this :

-------------------------------
The following are event logs for exceeded login failures from at on service apache (all time stamps are GMT +0100):
----
- Executed actions:
/etc/apf/apf -d at
------------------------------

Today i have a message again :

----------------------------------
The following are event logs for exceeded login failures from at on service apache (all time stamps are GMT +0100):
----
- Executed actions:
at was found inside a defined exclude file, or host has already been banned.
------------------------------------

Why the action not banned IP but "at" ?

[visiox]

Hi there,

I'm nut sure if I understand your posting...

at was found inside a defined exclude file, or host has already been banned

"at" was already banned/blocked yesterday

[chirpy]

I'd suggest you go to the app developers forums and ask for support since this is not cPanel related. Check you have updated versions of their apps installed, though.

[isputra]

Hi there,

I'm nut sure if I understand your posting...

"at" was already banned/blocked yesterday

Sorry for my poor language

What i mean is that if APF banned IP, the Executed actions:
/etc/apf/apf -d 111.111.111.111

But on my case, APF banned "at" not the IP.

[fleksi]

upgrade your APF to the latest version, you will have only IPs in your deny_hosts.rules

-fl-

[MakassarNET]

The APF is actually already perform those command. Try to login to your server as root and try those command. You will notice that the IP is already in the ban list. They sending you those command include the action that the visitor doing to your server. So it doesn't mean that you need to perform those command again.


Regards,

[isputra]

upgrade your APF to the latest version, you will have only IPs in your deny_hosts.rules

-fl-

OK, upgrade apf to 0.9.6

Anyone have an example of conf.apf and for antidos that works with cpanel ? Mine is works but i want to know how others conf to have better performance for my server.

Also, how to know that APF and BFD is running ? After upgrade, now i never have a message from APF that i received everyday.

Do apf -r and bfd -s but still did not received the email from APF

Thanks.