Infrastructure
  1. Infrastructure
  2. INFRA-5421

External IP (65.50.196.130) appears to have been blacklisted.

    Details

    • Type: Task Task
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Fix Version/s: Initial Clearing
    • Component/s: None
    • Labels:
      None

      Description

      Hi folks -- it appears that we have been blacklisted from the apache SVN repo again. This has happened before (INFRA-5113), and we instated logging internally to monitor traffic to the repo's IP (140.211.11.4).

      As I am looking over our connections for the past two days, I'm not seeing anything crazy.... Approximately 5500 connections spaced out very evenly over the last two days. What are you seeing on your end?

      We'd like to get this back un-blacklisted, and work to figure out what could have triggered it.

      Thanks!
      -- Will Chase

        Issue Links

          Activity

          Will Chase created issue -
          Will Chase made changes -
          Field Original Value New Value
          Link This issue is related to INFRA-5113 [ INFRA-5113 ]
          Hide
          Will Chase added a comment -
          Also, if there are any crazy spikes or specific triggering events, we'd appreciate timestamps around there to track this down internally.

          Our logs are only tracking established TCP connections, nothing more, so those problematic timestamps will help drill down more if the problem is on our end.

          Thanks again,
          -- Will
          Show
          Will Chase added a comment - Also, if there are any crazy spikes or specific triggering events, we'd appreciate timestamps around there to track this down internally. Our logs are only tracking established TCP connections, nothing more, so those problematic timestamps will help drill down more if the problem is on our end. Thanks again, -- Will
          Hide
          #asfinfra IRC Bot added a comment -
          <danielsh> Hi Will, we saw 780000 log entries on Wednesday, and fail2ban took those and the previous instance (back in August) as a 'pattern' and blocked you. I'll revert that block shortly. We also saw on Monday repeated attempts to SSH to loaner@people.apache.org from your IP.
          Show
          #asfinfra IRC Bot added a comment - <danielsh> Hi Will, we saw 780000 log entries on Wednesday, and fail2ban took those and the previous instance (back in August) as a 'pattern' and blocked you. I'll revert that block shortly. We also saw on Monday repeated attempts to SSH to loaner@people.apache.org from your IP.
          #asfinfra IRC Bot made changes -
          Status Waiting for Infra [ 10011 ] Closed [ 6 ]
          Resolution Fixed [ 1 ]
          Hide
          Will Chase added a comment -
          Hey Daniel -- thanks for the help. Regarding the 780k log entries from yesterday (Wednesday the 18th), can you give us a timestamp around when that began to peak (and timezone)? We have the problematic service narrowed down to a few candidates, but a timestamp would really help pinpoint.

          Cheers,
          -- Will
          Show
          Will Chase added a comment - Hey Daniel -- thanks for the help. Regarding the 780k log entries from yesterday (Wednesday the 18th), can you give us a timestamp around when that began to peak (and timezone)? We have the problematic service narrowed down to a few candidates, but a timestamp would really help pinpoint. Cheers, -- Will
          Hide
          #asfinfra IRC Bot added a comment -
          <danielsh> It seems as though someone was walking the history in 100-revision increments. That's similar but not quite the pattern of a 'git svn checkout'. See: https://svn-master.apache.org/temp/INFRA-5421.bz2
          Show
          #asfinfra IRC Bot added a comment - <danielsh> It seems as though someone was walking the history in 100-revision increments. That's similar but not quite the pattern of a 'git svn checkout'. See: https://svn-master.apache.org/temp/INFRA-5421.bz2
          Gavin made changes -
          Fix Version/s Initial Clearing [ 12325964 ]

            People

            • Assignee:
              Unassigned
              Reporter:
              Will Chase
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development