I'm wondering if this is a common problem for XOOPS users. I had my first attack yesterday and it knocked the site offline. The Web host has had to remove the site from the web to kill the attacks.

Have you experienced and attack on your site, and if so what kind and how severe?

- If so, how did you remedy it?

- What kind of protection do we XOOPS webmasters have against this kind of thing?

- Is this a large enough problem for the XOOPS team to devote more time to making the system safer?


Don't get me wrong. I love Xoops. My site ran flawlessly for over a year before it got nailed. I regularily upgraded the security patches. And I'm going to continue to be a XOOPS member and user. But now that XOOPS is getting bigger, I'm concerned that we may be becoming a bigger target.

Should we focus more on security?

Dos attacks has nothing to do with Xoops, only the webserver itself (eg apache iis etc) is vunerable for these attacks. It is the task of your hosting administrator to take care of these things.

the Protector module has anti DoS measures built into it.

Herko

Quote:

They've been defending it for a while but it got to be too much. They're monitoring it closly to see if they can figure it out.

Quote:

Cool! Thanks I'll get right on installing it. Any tips or tricks? :)

I noticed yesterday that my protector module logged 4 ips for DoS attack on my site, this is the first time since installing protector(since its first release) that ive ever had anything logged i.e no attacks, now im reading on here about people suffering dos attacks on thier XOOPS sites.

I had 4 ip's i used neotrace pro to trace them one was using my isp and traced back to right where I live(Scotland UK) which I thought was very strange one traced to Las Vegas, USA one to cherwell, England cant remember what the final one was.

Question is was this an attack direct on my site or just an attack on my server(shared hosting server)?

Seems a strange coincidence now that people are reporting DoS attacks on thier XOOPS sites.

worms scour the internet looking for machines to infect, the methods they use can sometimes be detected by firewalls as a dos attack.. 4 logs isn't really significant to worry.. but many consecutive attacks is something you should look into..

my firewall used to detect my ISP as a dos attack against me.. this was due to me having all ICMP pings blocked etc etc.. an isp pings u to see if ur online or using ur computer, if it's idle then they issue a disconnect command.. many dos attacks that are only occasional are probably just recorded as dos attacks incorrectly by the firewall.. so really you should only pay more attention to continuous attacks that are in significant numbers..