Server problem - any ideas

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Tipsy
    Confirmed User
    • Jul 2001
    • 6989

    #1

    Server problem - any ideas

    I've never come across this problem before. Rebooting doesn't help and none of the running processes are taking much in the way of resources or memory....

    The pages are served very fast, ssh is fast once in but...

    Anything that requires authentication is at a crawl. It takes minutes for SSH to actually login, e-mail is failing because it's taking too long, the server also has webmin running which is at a crawl too. Like I say though everything else is fine from script pages through to mysql queries.

    First thought was brute force attack but wouldn't that also be having an affect on overall speed not just authentication stuff? I can also see nothing else to suggest one.

    Any suggestions?
    Ignorance is never bliss.
  • funkmaster
    So Fucking Banned
    • Sep 2001
    • 7938

    #2
    I guess you are running on freebsd ... what does "netstat" say ?

    Comment

    • - Jesus Christ -
      Confirmed User
      • Mar 2003
      • 7197

      #3
      kill bind...

      see what happens... if your running RH8 and a recent version of bind I'm gussing that will fix it.. I had the same problem and I just use a seperate nameserver.

      Alternativly try switching your nameservers to somthing else. It definatly sounds like a DNS problem.

      Amen

      Comment

      • Tipsy
        Confirmed User
        • Jul 2001
        • 6989

        #4
        Originally posted by funkmaster
        I guess you are running on freebsd ... what does "netstat" say ?
        Thanks. Taking far too long to run but results are interesting. Looks like it may be an attack after all.

        Certainly not DNS stuff. Bind isn't running on that server as other servers are used for DNS and domains not on this server are fine.
        Ignorance is never bliss.

        Comment

        • funkmaster
          So Fucking Banned
          • Sep 2001
          • 7938

          #5
          Originally posted by Tipsy


          Looks like it may be an attack after all.
          ... been there, done that, got the t-shirt and the video !

          btw: try switching ssh to another port.

          Comment

          • strainer
            Confirmed User
            • Oct 2002
            • 418

            #6
            Type:

            top

            What does it say:

            Comment

            • buran
              Confirmed User
              • Mar 2002
              • 264

              #7
              Slow SSH is often a failure in reverse DNS. Your webpages probably have dns resolution off, so they're not affected.

              netstat -an should run much faster than netstat, it won't be doing any lookups.

              try ping www.gofuckyourself.com
              ping www.mit.edu
              ping www.ind.net

              see how quickly it resolves each of those domains. It's a
              worth ruling out anyway.

              b.
              [this signature intentionally left blank]

              Comment

              • Ludedude
                Suck it!
                • Jun 2001
                • 4432

                #8
                Last night must have been active.

                We got creamed by a pw hack attempt that was only effective as a DOS. Took a while to figure out wtf was going on.

                Does anyone share a list of known cracker IP addys? Be easiest to block those fuckers at the router before they even start.

                Comment

                Working...