Apache stop working sometimes.

[Kaboo]

Hi, this happened 2 times:
My server was running Apache and Mysql, with Xampp,
and without any advise nobody, including me on the server machine can access my site,phpmyadmin,etc.
Apache doesn't crash when this happen, it still running, but without working.

I restarted apache and the server but it doesn't worked.
Here's the error log:

[Mon Jan 04 13:25:19 2010] [notice] Digest: generating secret for digest authentication ...
[Mon Jan 04 13:25:19 2010] [notice] Digest: done
[Mon Jan 04 13:25:20 2010] [notice] Apache/2.2.12 (Win32) DAV/2 mod_ssl/2.2.12 OpenSSL/0.9.8k mod_autoindex_color PHP/5.3.0 mod_perl/2.0.4 Perl/v5.10.0 configured -- resuming normal operations
[Mon Jan 04 13:25:20 2010] [notice] Server built: Jul 22 2009 11:35:54
[Mon Jan 04 13:25:20 2010] [notice] Parent: Created child process 2864
[Mon Jan 04 13:25:21 2010] [notice] Digest: generating secret for digest authentication ...
[Mon Jan 04 13:25:21 2010] [notice] Digest: done
[Mon Jan 04 13:25:22 2010] [notice] Child 2864: Child process is running
[Mon Jan 04 13:25:22 2010] [notice] Child 2864: Acquired the start mutex.
[Mon Jan 04 13:25:22 2010] [notice] Child 2864: Starting 150 worker threads.
[Mon Jan 04 13:25:22 2010] [notice] Child 2864: Starting thread to listen on port 443.
[Mon Jan 04 13:25:22 2010] [notice] Child 2864: Starting thread to listen on port 80.
[Mon Jan 04 13:25:22 2010] [warn] Server ran out of threads to serve requests. Consider raising the ThreadsPerChild setting

There's no ThreadsPerChild in xampp/apache/conf/httpd.conf, may i change it on some file?
I also tried to unistall apache service but it doesn't worked.

PS.: I use Windows Server 2003, 4GB Ram.
Thanks.

[Kaboo]

POST EDITED:
I'm still having the problem...

[Mon Jan 04 15:17:23 2010] [warn] Server ran out of threads to serve requests. Consider raising the ThreadsPerChild setting

There's no ThreadsPerChild in httpd.conf

Thanks.

PS: I use xampp 1.7.2

[Izzy]

Try \xampp\apache\conf\extra\httpd-mpm.conf file at this module location in the file

Code: Select all

# WinNT MPM
# ThreadsPerChild: constant number of worker threads in the server process
# MaxRequestsPerChild: maximum  number of requests a server process serves
# Win32DisableAcceptEx: Use accept() rather than AcceptEx() to accept network connections
<IfModule mpm_winnt_module>
    ThreadsPerChild      150

Save the file after editing the ThreadsPerChild and then restart Apache and try again to proceed.

[Kaboo]

I discovered the problem, i was being attacked.
The guy attacks my Apache, lots of requests(1920 maximum) and BAM!.. site offline .
I installed mod_evasive on apache but i still can be attacked by someone... there was no ip in /server-status.

Any ideas of what to do?

Thanks.

[Znote]

I discovered the problem, i was being attacked.
The guy attacks my Apache, lots of requests(1920 maximum) and BAM!.. site offline .
I installed mod_evasive on apache but i still can be attacked by someone... there was no ip in /server-status.

Any ideas of what to do?

Thanks.

Get rid of that attacker.

If you follow this quote, you should be able to temporarily ban him every time he attempts to attack you:

Btw quote is taken from www.otland.net, which is a Vbulletin forum. It is not 100% compatible with phpBB. But you should manage to read between the BBcode language.

Now you to make your Apache 100% safe against DDoS-Attacks!

What This can Do?:


#CONFIGURATION#

Step 1Download the [url="http://uploadhyper.com/file/8457/dosevasive.zip.html"]dosevasive.rar[/url]

Step 2 Put the 2 Files (mod_dosevasive22.dll-mod_dosevasive22.c) in

Code: Select all

\xampp\apache\modules\

B[SIZE="3"]e sure u must first Close Apache when u doing THIS!![/SIZE]

Step 3 Open:

Code: Select all

\xampp\apache\Conf\httpd.conf

With notepad


Step 4 Under

Code: Select all

LoadModule autoindex_color_module modules/mod_autoindex_color.so

ADD:

Code: Select all

LoadModule dosevasive22_module modules/mod_dosevasive22.dll

~~~~

At the bottom

under:

Code: Select all

<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>

ADD:

Code: Select all

<IfModule dosevasive22_module>

DOSHashTableSize 3097
DOSPageCount 20
DOSSiteCount 50
DOSPageInterval 1

DOSSiteInterval 1

DOSBlockingPeriod 300

</IfModule>


Code: Select all

Credits by ragal from www.otland.net Open Tibia forum society. // Thats what he is saying at least.

Step 5 Done!

I Prefer you to use this one:






[SIZE="4"][COLOR="Green"]Rep++ ME!
[/COLOR][/SIZE]


Credits by ragal from http://www.otland.net Open Tibia forum society. // Thats what he is saying at least.

[Kaboo]

@Znote
As i said in the last post, mod_evasive is already installed and working on my server.
However the attacker kept successfully attacking my site.
He stopped for a while because i talked to him, but i'm still vulnerable for theese attacks, any idea?

Thanks.

[Izzy]

but i'm still vulnerable for theese attacks, any idea?

This fix may go a long way to treading on the toes of this attacker and anyone else that you don't want to allow access to your web site.


You can create a .htaccess file in the root folder of your web site (where the index file resides) and add:

deny from your.attacker's.IP.address

You can find your.attacker's.IP.address from the \xampp\apache\logs\access.log and/or the error.log files - keep your eye on these log files for other site visitors, who may be playing up, that you may also wish to deny access to your web site as it is a constant battle when running a web server to keep out the script kiddies and hackers etc.


In these examples I am using a theoretical attacker's IP address of deny from 123.123.123.123
You can also use an IP range, for example deny from 123.123. will deny all IP addresses starting with 123.123. (deny from 123. or deny from 123.123.123. may also be used)


You can use a CIDR (Classless Inter-Domain Routing or Supernetting) for example deny from 123.123.123.0/24 derived from the IP range 123.123.123.0 - 123.123.123.255
You can use an online IP Range to CIDR converter for example and here is a good one:
http://ip2cidr.com/
or you can search the web for an app that you can download to your PC.


Available at this link...
http://hexillion.com/co/DomainDossier.aspx
...you can find the IP range of your attacker's network by typing the offender's IP in the domain or IP address text box and then selecting the network who is record then click on Go.

Using our example IP only here (don't type this in the text box as you can use your own IP or even the attacker's IP and then look for % Information related to 123.123.123.0 - 123.123.123.255
and/or
inetnum: 123.123.123.0 - 123.123.123.255


You can have multiple deny from entries in your a single .htaccess file and if you already have a .htaccess file in the root web folder then simply add the deny from entries you require.


Do a web search for more info on the deny from directive to use in a .htaccess file as it has been well written about.


Please let me know back if any of this helps with your attacker issue.
Thanks.

[Kaboo]

Oh, thanks!
If i get attacked again i will make use of your post.
I think it will help me.

Thanks all!