Hello guys!
I have one problem...
User acaunt: vivatkamil , vivatkamil111 and many other... flood my server every night ? WTF?

http://www.lfsforum.net/attach ... mp;stc=1&d=1297066904


How i stop this flood?

Obvious question, but have you tried banning them?

Quote from imthebestracerthereis :

Obvious question, but have you tried banning them?

Of course
But he have many accaunts...

Why administrators not make one system..
At one IP .. one accaunts?

hint: when lfs system ban any user for 30 days... - banned user make a new accaunt..

What about to ban them by IP adress at your firewall?

Quote from DEVIL 007 :

What about to ban them by IP adress at your firewall?

Why i ban hes IP ?
Where is LFS support

Give me IP to ban him
I know only accaunt at this guy.

You can use your firewall to find his IP. You can log all incoming traffic and look is his IP up in the log...

LOL ... i have many incoming traffic
40 IP .. whu is at vivatkamil ?

Why LFS Support not ban him ?

How would LFS support ban him, effectively?
Ban account, make new.
Ban IP, restart router.

If you're lucky enough that he's got a static IP, you can get it by looking at the dedi screen when he connects, afaik.

Quote from amp88 :

Might help...

lol, now i remember... dedictet have logs ! yea... good idea
Now i wait to see ip


But don`t understand... have any method /not with firewall/ to ban IP

Thanks !

Quote from vvip :

But don`t understand... have any method /not with firewall/ to ban IP

Thanks !

Only using LFS: No
Using LFS along with reading log file: Yes

Thanks

Sorry for double post..

New flooder:
acc: yanyananil
ip: 78.177******

For all hosters

i think the LFS forum mods frown upon "naming and shaming". you might want to remove that ip address m8.

Quote from dadge :

i think the LFS forum mods frown upon "naming and shaming". you might want to remove that ip address m8.

Thanks, i edit my post

NEWS!

Feb 13 02:46:12 Send Track : 77.89.*****
Feb 13 02:46:12 Send Track : 77.89.*****
Feb 13 02:46:16 Alive : 77.89.*****
Feb 13 02:46:16 Connect : 77.89.*****
Feb 13 02:46:17 A new guest is connecting
Feb 13 02:46:20 STORE : OVERFLOW - ADMIN
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 FATAL TCP ERROR : CONNRESET
Feb 13 02:46:20 Lost connection to Deadcaster
Feb 13 02:46:21 Lost connection to MMPOWER™ ГqЯAy
Feb 13 02:46:21 Lost connection to FROST
Feb 13 02:46:30 Steve Meade Designs^L timed out
Feb 13 02:46:47 BLANK : OVERFLOW - ADMIN
Feb 13 02:47:00 › HOST : Emergency Restart

...

Quote from vvip :

NEWS!

Feb 13 02:46:12 Send Track : 77.89.*****
Feb 13 02:46:12 Send Track : 77.89.*****
Feb 13 02:46:16 Alive : 77.89.*****
Feb 13 02:46:16 Connect : 77.89.*****
Feb 13 02:46:17 A new guest is connecting
Feb 13 02:46:20 STORE : OVERFLOW - ADMIN
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 Steve Meade Designs^L connected (vivatkamil1111^L)
Feb 13 02:46:20 FATAL TCP ERROR : CONNRESET
Feb 13 02:46:20 Lost connection to Deadcaster
Feb 13 02:46:21 Lost connection to MMPOWER™ ГqЯAy
Feb 13 02:46:21 Lost connection to FROST
Feb 13 02:46:30 Steve Meade Designs^L timed out
Feb 13 02:46:47 BLANK : OVERFLOW - ADMIN
Feb 13 02:47:00 › HOST : Emergency Restart

...

Doesn't that kinda means he has admin password? :S

Tried changing it, yet?

Quote from E.Reiljans :

Doesn't that kinda means he has admin password? :S

Tried changing it, yet?

LOL, no !
He flood server..

I change Port,password .. all
But he flood again.. and again...

Just ban his IP in your firewall.

It's possible to join every server as admin and as any account. Joining as admin is easy but as other LFSW account it's harder to do. I didn't that but someone did it on my server. It's really awesome when you change password and he is coming as admin back.

Quote from vvip :

Of course
But he have many accaunts...

Why administrators not make one system..
At one IP .. one accaunts?

hint: when lfs system ban any user for 30 days... - banned user make a new accaunt..

because people like my household have 2 accounts, for 2 different people. Me and my brother.

Hmm..

4/5 maximum accaunts at IP ?

Quote from vvip :

Hmm..

4/5 maximum accaunts at IP ?

I don't think this is the way to go. First, there are people behind large NATs that would be affected. It would also be kind of hard to constantly monitor accounts and IPs they use. Add dynamic IPs to the mix and you have a technically difficult solution that would cause more problems than it would solve.

I still don't understand what problem do you have exactly. LFS doesn't allow for more than one computer to use an account online an the same time. The guy who is flooding your server can apparently connect multiple times with one account, so he has to hack around this protection somehow.
The only solution I see is to specifically ban IPs of these attackers, LFS account policy won't help you much in this case...

try this, it may help if the IP is static, I am not sure if it can block a range though. Its worth a try?

http://www.geardownload.com/se ... /beethink-ip-blocker.html

connects same 4 usernames in one server hmm that must be hacked let scawen reviewed this