Urgent help needed :) please

[zappdk]

Hi, this might be a long thread, but I tried to include as much infomation as possible.
First my problem, then the information.

My problem is that my websites "go down" around 1-2 times a day, the server works fine and when I ping it is respondig, but I cant acces the websites?

I can log in to DirectAdming through the ":2222" port, this works fine.

But sometimes i cant access my websites, it changes what time this happens, sometimes it is at night, sometimes it is around noon.

I hope you can help me, if you need more information, then what I have included downunder, just say so

And if there is anything I should mask in the information I give you, because it is nonsecure, then please tell me

My information:
I have a dedicated server with following configuration:

Processor Name Intel(R) Xeon(R) CPU 3050 @ 2.13GHz
Vendor ID GenuineIntel
Processor Speed (MHz) 2133.507
Processor Name Intel(R) Xeon(R) CPU 3050 @ 2.13GHz
Vendor ID GenuineIntel
Processor Speed (MHz) 2133.507
Total Memory 2075520 kB
Free Memory 57004 kB - (Every time I cant access the websites, it is this low, then when I can access the websites again its around 500mb)
Total Swap Memory 4192956 kB
Free Swap Memory 4192888 kB
System Uptime 3 Days, 13 Hours and 21 Minutes
Apache 2.2.6 Running
DirectAdmin 1.31.0 Running
Exim 4.67 Running
MySQL 5.0.45 Running
Named 9.3.3rc2 Running
ProFTPd 1.3.1 Running
sshd *** Stopped *** (I stopped it because my websites dont need it, in logs I could see that some sites, I dont know, were trying to acces it?)
vm-Pop3d 1.1.7f-DA-2 Running

My websites is www.nicheserver.com, just 1-2 pages of information and www.updownloading.com, a fileupload site, not so many visitors, maybe 10-20 a day, I just started

I bought the domainname from a existing website, and it seems there is something from the old contact or something, cause I get e-mails to [email protected] from people and websites I dont ever heard about.
And IP's and websites trying to access thing there is not there? and login with usernames that I dont know about? Thats why I stopped sshd, cause it was mainly this they tried to access.

Logs
I have Bolded, what seems weird and suspecious for me.

exim/mainlog:
007-12-02 06:01:06 1Iygx0-000804-Ju <= [email protected] H=cpe-74-75-106-164.maine.res.rr.com (agou.ab8r2.adelphia.net) [74.75.106.164] P=esmtp S=1037 id=25644641329640.F74F65E36D@P0ZP2W T="Taste high society life" from <[email protected]> for [email protected]
2007-12-02 06:01:06 1Iygx0-000804-Ju => support <[email protected]> F=<[email protected]> R=virtual_user T=virtual_localdelivery S=1201
2007-12-02 06:01:06 1Iygx0-000804-Ju Completed
2007-12-02 06:20:03 1IyhFL-000829-PZ <= [email protected] H=84.122.69.108.dyn.user.ono.com [84.122.69.108] P=esmtp S=1803 id=000a01c834a3$011f9b5e$df6b82bb@stwosye T="V|aggra 50mg x 60 pi1ls = $ 89.95" from <[email protected]> for [email protected]
2007-12-02 06:20:03 1IyhFL-000829-PZ => support <[email protected]> F=<[email protected]> R=virtual_user T=virtual_localdelivery S=1967
2007-12-02 06:20:03 1IyhFL-000829-PZ Completed
2007-12-02 14:09:00 1IyoZA-0000Oq-S7 <= [email protected] U=apache P=local S=804 id=6ea40e18c20af25f03b7685c0b19c1ac@fusion-planet.updownloading.com T="Fusion Planet: Subject" from <[email protected]> for [email protected]
2007-12-02 14:09:01 1IyoZA-0000Oq-S7 => [email protected] F=<[email protected]> R=lookuphost T=remote_smtp S=828 H=gmail-smtp-in.l.google.com [64.233.183.27] C="250 2.0.0 OK 1196601041 f4si8460636nfh"
2007-12-02 14:09:01 1IyoZA-0000Oq-S7 Completed
2007-12-02 14:09:40 1IyoZm-0000Ox-Vw <= [email protected] H=77-253-128-64.adsl.inetia.pl [77.253.128.64] P=esmtp S=977 [email protected] T="ixemflah" from <[email protected]> for [email protected]
2007-12-02 14:09:40 1IyoZm-0000Ox-Vw => support <[email protected]> F=<[email protected]> R=virtual_user T=virtual_localdelivery S=1183
2007-12-02 14:09:40 1IyoZm-0000Ox-Vw Completed

httpd/access_log: Is this many 404 normal, I get around 10-20 visitors daily. Some times at the bottom it says something like: "....you should increase your Maxclient settings" ? I tried to find this maxclient thing in the conf/httpd.conf file, but I cant find anything about max client, is it something that I am manually going to ad, if it is then how?

::1 - - [02/Dec/2007:16:06:41 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:42 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:43 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:44 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:45 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:46 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:47 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:48 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:49 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:50 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:51 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:52 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:53 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:54 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:55 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:56 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:57 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:58 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:06:59 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:00 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:01 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:02 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:03 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:04 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:05 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:06 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:07 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:08 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:09 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:10 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:11 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:12 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:13 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:14 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:15 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:16 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:17 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:18 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:19 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:20 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:21 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:22 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:23 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:24 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:25 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:26 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:27 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:28 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:29 +0100] "GET /" 404 -
::1 - - [02/Dec/2007:16:07:30 +0100] "GET /" 404 -

httpd/error_log:
[Sun Dec 02 16:07:03 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:04 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:05 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:06 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:07 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:08 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:09 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:10 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:11 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:12 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:13 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:14 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:15 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:16 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:17 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:18 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:19 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:20 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:21 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:22 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:23 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:24 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:25 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:26 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:27 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:28 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:29 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:30 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:31 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:32 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:33 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:34 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:35 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:36 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:37 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:38 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:39 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:40 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:41 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:42 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:43 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:44 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:45 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:46 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:47 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:48 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:49 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:50 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:51 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml
[Sun Dec 02 16:07:52 2007] [error] [client ::1] File does not exist: /var/www/html/400.shtml

in the daily log i get send to my e-mail this I think is suspecious:
--------------------- httpd Begin ------------------------


Requests with error response codes
404 Not Found
/: 978 Time(s)

---------------------- httpd End -------------------------
some times the 404 NOT FOUND is as high as around 1500 Time(s)

I have a suspicion that it is the max client setting in httpd, that is the problem? but I cant find it in the conf/httpd.conf, how and where in httpd.conf do I set the max client higher?

If you dont think it is that, then what do you think it is?

And how can I secure my server better,if possible with free programs/scripts?

and how do I exactly install the scripts , but this I will wait untill later, first thin urgent problem with website downtime, I hope you can help me.

Thanks in forward for your help.


Best regards...

 

[zappdk]

Still urgent, nobody knows why it stoppes responding a couple of times daily?

 

[nobaloney]

The log entries you've bolded are simply people sending spam. Ignore the entries, or use SpamBlocker and/or SpamAssassin to block the Spam.

The apache errors look like missing error files; the httpd.conf file probably calls for specific error files that don't exist on your server. In that case any search triggering that error page will give that error.

Since you bought the domain second-hand you have no idea what's trying to hit it. It could be something as simple as a search engine; you might want to look into how you'd use a robots.txt file to block search engines. (Be careful; this could block legitimate searches as well.)

The MaxClients setting is spelled MaxClients; if you can't find it, add it near the top; on at least one of my servers it's on line 16 of the /etc/httpd/conf/httpd.conf file; on yours it may be elsewhere.

And how can I secure my server better,if possible with free programs/scripts?

Unfortunately it's not that simple. Security is an ongoing project. If you're not a competent administrator you may want to purchase third-party systems administration. Or you can search these forums for suggestions for firewalls, php hardening, etc.

Jeff

 

[andyreed]

But sometimes i cant access my websites, it changes what time this happens, sometimes it is at night, sometimes it is around noon.

That means your server either comes under Syn attack from time to time, or the server CPU load is high. You can read about the causes of high server load at: http://servertune.com/kbase/entry/67/

sshd *** Stopped *** (I stopped it because my websites dont need it, in logs I could see that some sites, I dont know, were trying to acces it?)
vm-Pop3d 1.1.7f-DA-2 Running

You don't have or need to disable sshd. You might want to change Shell Port from the default 22 to something else.

exim/mainlog:
007-12-02 06:01:06 1Iygx0-000804-Ju <= [email protected] H=cpe-74-75-106-164.maine.res.rr.com (agou.ab8r2.adelphia.net) [74.75.106.164] P=esmtp S=1037 id=25644641329640.F74F65E36D@P0ZP2W T="Taste high society life" from <[email protected]> for [email protected]

Enable SpamAssassin (SA) or SpamBlocker and update SA rules to minimize spam on your server.

httpd/access_log: Is this many 404 normal, I get around 10-20 visitors daily. Some times at the bottom it says something like: "....you ::1 - ::1 - - [02/Dec/2007:16:06:42 +0100] "GET /" 404 -

If you are receiving "404 file not found" errors, you need to add the error files: 404.shtml, 401.shtml, 500.shtml, robots.txt and favicon.ico in the root directory of your site.[/quote]

And how can I secure my server better,if possible with free programs/scripts?

We wrote an article about Security Tips at:
http://servertune.com/kbase/entry/89/

Security is not a "set it and forget it" proposition. Because there are no absolutes, constant monitoring is essential. New attacks are being developed every day and if you're simply going to respond once an attack is discovered it's likely too late. Hackers will use every possible means to disguise other, more intrusive, exploits. In many cases simply waiting for obvious evidence that you've been hacked means you'll never know you've been hacked. The hackers will sneak in, grab what they want, and sneak back out again covering their tracks as they go. In short, secure and harden your server pretty well. If you are very comfortable with Linux OS, you can seek professional help from a third-party company. Hope this helps!

 

[resolveit]

And how can I secure my server better,if possible with free programs/scripts?

I'm not going to comment on any of the other things as I believe Jeff and Andy (think it's Andy) have given you an adequate answer.

For Security I found this thread on this forum, you can also search this forum for "ELS" (or Easy Linux Security). I believe it does the basics and more and it should be sufficient to get you started.

Regards,

 

[zappdk]

Thank you very much for your helps, I am currently reading through the links.

I hope I get hold of this server management thing soon


I posted but it didnt show so I try again

I have made some changes to httpd.conf, I hope you have the time to look it through to see if it seems right

I thank in forward for your time.

(should I mask some informations in httpd.conf, before I post it here? is there any risk?)

here you go...
START OF HTTPD.CONF
..............................
#
# This is the main Apache HTTP server configuration file. It contains the
# configuration directives that give the server its instructions.
# See <URL:http://httpd.apache.org/docs/2.2> for detailed information.
# In particular, see
# <URL:http://httpd.apache.org/docs/2.2/mod/directives.html>
# for a discussion of each configuration directive.
#
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.

MaxKeepAliveRequests 0
KeepAliveTimeout 15
MinSpareServers 16
MaxSpareServers 64
StartServers 16
MaxClients 512
MaxRequestsPerChild 100000

ErrorDocument 400 http://www.nicheserver.com/public_html/errordoc-400.shtml
ErrorDocument 401 http://www.nicheserver.com/public_html/errordoc-401.shtml
ErrorDocument 403 http://www.nicheserver.com/public_html/errordoc-403.shtml
ErrorDocument 404 http://www.nicheserver.com/public_html/errordoc-404.shtml
ErrorDocument 500 http://www.nicheserver.com/public_html/errordoc-500.shtml

ServerRoot "/etc/httpd"
Listen 80

#LoadModule php4_module /usr/lib/apache/libphp4.so
LoadModule php5_module /usr/lib/apache/libphp5.so
#LoadModule suphp_module /usr/lib/apache/mod_suphp.so
LoadModule php5_module /usr/lib/apache/libphp5.so

User apache
Group apache

ServerAdmin admin@localhost
DocumentRoot "/var/www/html"

<Directory /home/*>
AllowOverride All
Options -MultiViews -Indexes +FollowSymlinks +IncludesNoExec +Includes
<Limit GET POST OPTIONS PROPFIND>
Order allow,deny
Allow from all
</Limit>
<LimitExcept GET POST OPTIONS PROPFIND>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>

<Directory />
Options All
AllowOverride All
</Directory>

<Directory "/var/www/html">
Options +Indexes +FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
<IfModule mod_suphp.c>
suPHP_Engine On
suPHP_UserGroup webapps webapps
</IfModule>
</Directory>

<IfModule dir_module>
DirectoryIndex index.html index.htm index.shtml index.php index.php5 index.php4 index.php3 index.phtml index.cgi
</IfModule>

<FilesMatch "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>

ErrorLog /var/log/httpd/error_log
LogLevel warn

<IfModule log_config_module>
#replace %b with %O for more accurate logging
<IfModule logio_module>
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%O" bytes

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
</IfModule>

CustomLog /var/log/httpd/access_log common
</IfModule>

<IfModule alias_module>
# Include some DirectAdmin alias
Include conf/extra/httpd-alias.conf
</IfModule>

<Directory "/var/www/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>

DefaultType text/plain

<IfModule mime_module>
TypesConfig conf/mime.types
AddType application/x-gzip .tgz
AddEncoding x-compress .Z
AddEncoding x-gzip .gz .tgz
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddHandler cgi-script .cgi
AddHandler type-map var
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
AddType video/x-ms-asf .avi
AddType video/mpeg .mpg
AddType video/mpeg .mpeg
AddType video/quicktime .mov
AddType video/x-ms-wmv .wmv
</IfModule>

#EnableMMAP off
#EnableSendfile off

#######################################################################################
# Do not change anything in included files, because they are rewritten by DirectAdmin #
#######################################################################################

# This is needed for PHP
Include conf/extra/httpd-php-handlers.conf

# Server-pool management (MPM specific)
Include conf/extra/httpd-mpm.conf

# Multi-language error messages
Include conf/extra/httpd-multilang-errordoc.conf

# Fancy directory listings
Include conf/extra/httpd-autoindex.conf

# Language settings
Include conf/extra/httpd-languages.conf

# User home directories
#Include conf/extra/httpd-userdir.conf

# Real-time info on requests and configuration
Include conf/extra/httpd-info.conf

# Virtual hosts
Include conf/extra/httpd-vhosts.conf

# Local access to the Apache HTTP Server Manual
#Include conf/extra/httpd-manual.conf

# Distributed authoring and versioning (WebDAV)
Include conf/extra/httpd-dav.conf

# Various default settings
Include conf/extra/httpd-default.conf

# Secure (SSL/TLS) connections
Include conf/extra/httpd-ssl.conf

# Deflate module settings
Include conf/extra/httpd-deflate.conf

# All the DirectAdmin vhosts
Include conf/extra/directadmin-vhosts.conf

# All suPHP directives
Include conf/extra/httpd-suphp.conf

# All the other includes needed by the custombuild script
Include conf/extra/httpd-includes.conf

#######################################################################################
# End of included files that are rewritten by DirectAdmin #
#######################################################################################

<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>

---------------------
END OF HTTPD.CONF


Best regards, and thank you again