Forum

444, "Banned Due To Misconduct"

ConnectionsPerIP = 32

sudo lsof -n | grep TCP | grep http | grep ESTABLISHED

77.99.233.xxx|Tue 21 Jun 2016 13:01:12 +0100|Client banned because of flooding

####################################################################
# Hiawatha main configuration file
# Tuned for WordPress.

################ Set Variables #####################################
# variables are case-sensitive and cannot be re-declared.
#
 set LOCALHOST = 127.0.0.0/8
 set MyIPv4 = 10.8.20.xxx
 set TrustedIP_1 = 82.27.197.xxx         # Whitelist office IP Address (red hall drive)
 set TrustedIP_2 = 86.8.75.xxx           # Whitelist Head Office IP Address (stonegate road)
 set TrustedIP_3 = 10.8.20.xxx            # WHitelist proxy server IP Address

################ General Settings ##################################
 #MonitorServer = 192.168.1.125                         #  IP address of the Hiawatha Monitor server
 ServerString = Hiawatha
 ServerId = www:www
 HideProxy = 10.8.20.xx
 ConnectionsTotal = 4096                                # Maximum number of simultaneous connections. Default = 100
 ConnectionsPerIP = 32                                  # Maximum number of simultaneous connections per IP address. Default = 10
 MaxUrlLength = 1000                                    # Maximum length of the path of an URL that the webserver accepts as being valid
                                                        # Otherwise, a 414 error code is returned
                                                        # Default = 1000
 SystemLogfile = /var/log/hiawatha/system.log
 GarbageLogfile = /var/log/hiawatha/garbage.log
 ExploitLogfile = /var/log/hiawatha/exploit.log         # xss sqli etc
 #ThreadKillRate = 10                                   # Free unused threads
 #CacheSize = 8                                         # Size of Hiawatha's internal file cache. Maximum is 1024 (megabytes). Default = 10
 #CacheMaxFilesize = 512                                # Maximum size of a file Hiawatha will store in its internal cache. Default = 256
 MinTLSversion = 1.2                                    # Specify the minimum TLS version Hiawatha accepts for HTTPS connections
                                                        # Default = 1.1 (last updated 03/09/16)

 DHsize = 4096                                          # Set the size of the Diffie-Hellman key.
                                                        # Default = 2048

 SocketSendTimeout = 30                                 # Sets the SO_SNDTIMEO value for all client connection sockets
                                                        # Default = 3

 ReconnectDelay = 3                                     # How long connection wil stay open after no traffic

### Whitelist business IPs ###
 LogfileMask = deny LOCALHOST, deny MyIPv4, deny TrustedIP_1, deny TrustedIP_2, deny TrustedIP_3

 # This network can upload all they want
 RequestLimitMask = deny LOCALHOST, deny MyIPv4, deny TrustedIP_1, deny TrustedIP_2, deny TrustedIP_3

################ Binding Settings ##################################
 include bindings.conf

################ Banning Settings ##################################
# Deny service to clients who misbehave.

 # NEVER ban whitelisted IP Address
 BanlistMask = deny LOCALHOST, deny MyIPv4, deny TrustedIP_1, deny TrustedIP_2, deny TrustedIP_3
 KickOnBan = yes                                # Close all connections for an IP that is banned
 RebanDuringBan = yes                           # Reset the ban-time when a client tries to reconnect during a ban

 ChallengeClient = 200, httpheader, 60          # Challenge the client to verify that it's a real web browser and not an HTTP bot
 #ChallengeClient = 768, javascript, 15         # After 200 connects send a coockie
 BanOnFlooding = 10/1:15
 BanOnGarbage = 300                             # seconds
 BanOnInvalidURL = 60                           # seconds
 BanOnMaxPerIP = 15                             # seconds
 BanOnMaxReqSize = 300                          # seconds
 BanOnWrongPassword = 3:120                     # seconds
 BanOnSQLi = 3600                               # seconds
 BanOnDeniedBody = 120                          # seconds

################ Common Gateway Interface Settings #################

 CGIhandler = /usr/local/bin/ssi-cgi:shtml
 CGIhandler = /usr/local/bin/php-cgi:php

 FastCGIserver {
         FastCGIid = PHP5-FPM
         ConnectTo = /var/run/php-fpm.sock
         Extension = php
 }

  FastCGIserver {
         FastCGIid = PHP5_SHTML
         ConnectTo = /var/run/php-fpm.sock
         Extension = php, shtml
 }

################ URL Toolkit Settings ##############################
 include toolkit.conf

################ Directory Settings ################################
 include directory.conf

################ default Website Settings ##########################
# protect from automated webscanners
 Hostname = 127.0.0.1
 WebsiteRoot = /usr/local/www/hiawatha
 StartFile = index.html
 AccessLogfile = /var/log/hiawatha/default.access.log
 ErrorLogfile = /var/log/hiawatha/default.error.log
 #ErrorHandler = 404:/error.cgi

VirtualHost {
 Hostname = dev.mydomain.co.uk, www.dev.mydomain.co.uk
 WebsiteRoot = /usr/local/www/development/httpdocs
 #StartFile = index.php
 StartFile = index.shtml
 UseLocalConfig = yes                           # Tell Hiawatha to use or ignore .hiawatha files
 CustomHeader = X-Frame-Options: sameorigin
 CustomHeader = Vary: Accept-Encoding
 #RequireTLS = yes,31536000                     # Force TLS connection
 RandomHeader = 512                             # Anti decryption on https listening
 #TLScertFile = /usr/local/www/production/tls/softfloorkids.co.uk.pem
 AccessLogfile = /usr/local/www/development/httpdocs/logs/access.dev.softfloorkids.co.uk.log
 ErrorLogfile = /usr/local/www/development/httpdocs/logs/error.dev.softfloorkids.co.uk.log
 TimeForCGI = 15
 #UseFastCGI = PHP5-FPM
 UseFastCGI = PHP5_SHTML
 ExecuteCGI = yes                               # Allow execution of CGI programs.
                                                # Default = no

 #UseDirectory = cache-control-1w, cache-control-2w, cache-control-2m
 #UseToolkit = secure-wp, wordpress
 #UseToolkit = wordpress, cache-control
 #UseToolkit = wp-multi-subdir
 #UseToolkit = joomla
 UseToolkit = block_bots

################ Security Settings #################################

 DenyBody = ^.*%3Cscript.*%3C%2Fscript%3E.*$    # If the request body matches the case insensitive regular expression, return a 403 Forbidden

 #PreventCSRF = yes                             # Ignore all cookies sent by a browser when following an external link
                                                # Can cause problems for wordpress
                                                # Default = no

 #PreventSQLi = yes                              # Prevent SQL-injection by detecting injections and denying the request via a 403, 404 or 441 response.
                                                # NOT 100% guarantee, resource intensive!

 #PreventXSS = yes                               # Prevent cross-site scripting via the URL by replacing a less-then, greater-then, quote or double-quote in the URL with an underscore.
                                                # Default = no
 #WrapCGI = jail_dev.softfloorkids.co.uk
}

BanOnFlooding = 10/1:15