ziad87

Hm, I had created a CentOS VM with cPanel installed yet I couldn't get anything weird out of /tmp
Ill remove the deny from all for now, please let me know if /tmp fills up with anything weird.

Yeah, that is normal. It means your account is on the new NAS.

(As in the /home1/)

Okay, I'll debug once I'm back.

Hmm, okay. Could I maybe get a backup (everything, including mysql), so I could check if my /tmp fills up?

Hmm, I'm not sure. I have a lot of things and can't check..
What kind of tempdata did it store, if you still have some by any chance?

Hello, may I please ask why my account was suspended?

• Heliohost username: ziad87
• Server: Tommy

I'm guessing this is for CPU usage or full disk space..

How do they DDoS? Do they just keep wasting bandwidth? Can't there be a way to add some extra firewall rules?

Oh, that's why I wasn't able to reproduce it. My account is on /home not /home1

It is possible, but isn't the NAS and Tommy both on the same local network? Isn't the null routing only effective outside?

I don't think the cpanel problem is related to the attack, since its file creation error. 

Huh. The /cgi-sys/defaultwebpage.cgi isnt automatically redirected but instead to Rax Software.

Edit: What happened to your load gifs? It says [down] but its clearly up.

Edit 2: Also, the ssl certificate is invalid, and its apparently for rax2.heliohost.org

https://rax2.heliohost.org

The same cert is on https://tommy.heliohost.org/

http://he.net is the datacenter provider they use.

As for http://stress.wtf, it is possible but I'm not sure.

Edit: Also, was it null routed or is it still live?

cpsrvd seems to be working again, but maybe you could restart apache from WHM?

The attack started shortly after we banned ~150 phishing sites that signed up over the course of a week (mostly paypal phishing, and significantly more than normal), so my theory is that its retaliation for us banning some clown who wanted to phish paypal accounts.

Seems to be half working at times, but only barely. Even cpsrvd barely responds.

It seems Cody has taken a hit too. Helionet.org and Heliohost.org seem to be slower than usual.

There should be a feature in cpanel called Anonymous FTP, maybe the admins could enable it.

Or, you could simply drop the file into your public_html and direct them to example.com/file.ext

Usually a few hours, but soon on Johnny it may take months.

Sign ups are on a daily basis. When sign ups are full, they reset on midnight UTC.

Then you can sign up. After Johnny is more stable, he will have unlimited sign ups per day.

Um, you are able to proceed as HSTS is not enabled. Also you don't need WHM. It is only for the admins. The problem with cpanel DCVs are that they must check with non secure HTTP, any forcing of SSL will stop the certificate getting issued.

You can use wildcard domains on let's encrypt too.

Right. So now no RoR or .net 3.5?

Johnny has the latest cpanel now right?

Does cpanel login end with .php or .phpcp ? If not, logins will not count.

Go to ???.heliohost.org:2083/ without anything after the /

You may also try https://heliohost.org/login

Okay, I'll fix autossl. The forbidden error is normal as there is no content and I have a Options -Indexes .htaccess

Autossl usually works, don't know why it cares now. Can't it use DNS DCVs?

A while ago I tried adding a domain through a firewalled place. I had to disable client-side scripts or else it would redirect to heliohost.org/login. As such I dont think the domain added correctly, since I tried deleting it to change the subdomain and location. Trying to delete it shows:

Can you delete it and its associated DNS entries? Then I will re add it.

Also autossl seems broken. It normally signs in 5 minutes.

You install cpanel, it installs the latest release.

Now Johnny will be regaining his uptime. On the heliohost site at the bottom it shows online!

@Piotr GRD You should fix the monitor for Johnny. (and cpanel monitoring)

Okay. Thanks! 

10 seconds ≠ 10 minutes.

Propogation is fast!

Thanks! Good night (or good morning)!

Edit:

I am still IP blocked.

Okay, I am sorry. Either proxies are not allowed or I caused high load. Most probably the second one as I don't see anything regarding such proxies.

If it is the case of high load, I will create a subdomain CNAME record and host the proxy portion somewhere else. (it only needs PHP)

Thanks,

EDIT: Yeah, makes sense...

 

Because HelioHost is a free webhost, we have many accounts on our servers. If one account is using too many resources it slows down the server for everyone. Therefore, we are careful to suspend any account that is using more than its fair share of CPU cycles and memory. Note that more often than not, a HelioHost account's overuse is caused by running cron scripts too often. Other causes include running resource-intensive scripts, such as proxy software.

Please PM me a copy of the /home/ziad87/public_html/proxies folder as a ZIP.

Then please delete it, and unsuspend me. 

I really really hope I didnt just cause major downtime   

Either that, or I'm IP blocked.