George's questions

I have two servers: an Ubuntu/Apache web server and a Windows 2008 IIS7 server. I have one external static IP address. All web requests on port 80 are forwarded to my Ubuntu machine. The majority of my sites reside on the Ubuntu server, however, a specific site needs to be hosted out of the Windows 2008 machine. How can I forward requests for a specific Virtual Host on my Apache web server to IIS to another host on my network?

For instance, my Apache machine is 192.168.100.110 and all requests for www.example.com need to be forwarded transparently to 192.168.100.101. All web requests will always go through the Apache machine first.

How can I accomplish this?

I'm trying to debug which user (windows account) is responsible for actually writing a file from my ASP.NET site. When I set the permissions on the folder to everyone, I can write to the directory. When I set the permissions to my account, NETWORK SERVICE, or ASPNET I cannot write to the share. How can I determine what user is writing or trying to write to the share given a file?

The event log doesn't show any details.

We have an intranet site, with no known updates pushed to the server over the weekend. This morning, when attempting to validate with LDAP credentials via single sign on in IE, we receive Access Denied due to invalid credentials. However, FireFox works fine. And so does Chrome. This is the case for every system on our network.

Are there any known issues that would cause IE8 to stop authenticating with the correct user name and password on an intranet site, while FireFox would continue to work? To our knowledge, nothing has changed.

What are some things we should check for? What could possibly cause IE to suddenly stop working?

I have 2 machines and a router running DD-WRT. My machines are,

1. Windows 2008, running my DNS and IIS7
2. Ubuntu 11.4 Server, running Apache 2.

Currently I have all requests to my external IP address on port 80 forward to my Windows 2008 machine. I have added the additional Ubuntu server recently, and I would like to route the to the IP address based on the host. Currently there is only a 1 to 1 relationship between the port and the server, with all requests for port 80 going to the Windows 2008 machine. As an example, this is what I would want to do:

If I had a request come into my router for example-a.com, I would forward it to 192.168.1.2.

If I had a request for example-b.com', I would forward it to192.168.1.3`

Is this something that needs to be routed through my 2008 machine first, or can I do this from the router?

Using the DNS server at Zoneedit.com, I have created 2 sub domains:

Ns1.example.com and

Ns2.example.com

Both Ns1 and Ns2 resolve to my server, which also hosts a DNS server.

If I were to create new zones on my DNS server, could I point my registrar to Ns1 and Ns2.example.com and expect the domains I am the authoritative host for to resolve?

Essentially, Dotster would have to look up Ns1/2.example.com first, and then be forwarded to my DNS server, where the entries would be resolved.

Is this possible?

What is a good tool to identify what resources are causing the CPU to spike and flat line @ 100%? I have a server which has 10-15 websites on it and I need to figure out where the load is coming from and the pages causing the stress.

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our servers resources. A sample of the attacks would look as such:

2010-07-23 15:56:22 58.223.238.6 48681 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.6.4/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:23 58.223.238.6 48713 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.6.5/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:23 58.223.238.6 48738 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.6.6/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:24 58.223.238.6 48761 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.6.7/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:24 58.223.238.6 48784 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.6.8/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:24 58.223.238.6 48806 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.6.9/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:25 58.223.238.6 48834 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.0-beta1/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:25 58.223.238.6 48857 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.0-pl1/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:25 58.223.238.6 48886 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.0-pl2/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:27 58.223.238.6 48915 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.0-rc1/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:27 58.223.238.6 48997 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.0/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:28 58.223.238.6 49023 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.1/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:28 58.223.238.6 49044 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.2/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:28 58.223.238.6 49072 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.3/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:29 58.223.238.6 49094 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.4/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:29 58.223.238.6 49122 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.5/scripts/setup.php 400 - Hostname -
2010-07-23 15:56:30 58.223.238.6 49152 xxx.xx.xx.xx 80 HTTP/1.1 GET /phpMyAdmin-2.7.6/scripts/setup.php 400 - Hostname -

They are litterally hitting our servers 24/7, multiple times each second, looking to find an exploit. The IP addresses are always different, so adding rules to the firewall for these attacks only serve as short term solutions before they start up again.

I'm looking for a solid approach to identifying these attackers when the website is served. Is there a programatic way to add rules to IIS upon identifying a IP address or a better way to block these requests?

Any ideas or solutions for identifying and blocking these IP addresses would be very welcomed. Thanks!