Security Archives - FBU Tracking & Knowledge Base Mon, 06 May 2024 04:18:33 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.7 https://tracking.fivebranches.edu/wp-content/uploads/2024/03/cropped-fbu_icon-32x32.jpg Security Archives - FBU Tracking & Knowledge Base 32 32 Security: Schedule malware scan for once a week https://tracking.fivebranches.edu/website-maintenance/security-schedule-malware-scan-for-once-a-week/ https://tracking.fivebranches.edu/website-maintenance/security-schedule-malware-scan-for-once-a-week/#comments Mon, 08 Apr 2024 20:27:43 +0000 https://tracking.fivebranches.edu/?p=11606 Currently the malware scan is set on the 21st of the month. But for many websites it may require higher frenquency of scanning than that. Ask the Liquid Web support to change the setting to once a week to more closely monitoring FBU websites. Final settings: A cron job was set up to do daily ... Read more

The post Security: Schedule malware scan for once a week appeared first on FBU Tracking & Knowledge Base.

]]>

Currently the malware scan is set on the 21st of the month.

But for many websites it may require higher frenquency of scanning than that.

Ask the Liquid Web support to change the setting to once a week to more closely monitoring FBU websites.

Final settings: A cron job was set up to do daily scan at 3:10 am EST (or 12:10 am PST) starting 4/13/2024.

The scan path, as of 5/5/2024 is: /home/orguser/public_html/

An email notification will be sent if any malicious result is found.

The daily scan results can be found in WHM – ImunifyAV – Scan.

An extended ticket was issued (5/5/2024) to cover related subdomain websites:
Extended Ticket: 18350732

The scan paths now (5/5/2024) cover all paths related to the user “orguser”.

The post Security: Schedule malware scan for once a week appeared first on FBU Tracking & Knowledge Base.

]]> https://tracking.fivebranches.edu/website-maintenance/security-schedule-malware-scan-for-once-a-week/feed/ 1 WHM: Set security alert notifications https://tracking.fivebranches.edu/web-servers/whm-set-security-alert-notifications/ https://tracking.fivebranches.edu/web-servers/whm-set-security-alert-notifications/#respond Fri, 05 Apr 2024 18:31:14 +0000 https://tracking.fivebranches.edu/?p=11565 Set up notifications when either ImunifyAV detects malware or general alerts from server.

The post WHM: Set security alert notifications appeared first on FBU Tracking & Knowledge Base.

]]> Set up notifications when either ImunifyAV detects malware or general alerts from server.

The post WHM: Set security alert notifications appeared first on FBU Tracking & Knowledge Base.

]]> https://tracking.fivebranches.edu/web-servers/whm-set-security-alert-notifications/feed/ 0 Resolve the high volume of “Failed Login” on Alumni website https://tracking.fivebranches.edu/website-design/resolve-the-high-volume-of-failed-login-on-alumni-website/ https://tracking.fivebranches.edu/website-design/resolve-the-high-volume-of-failed-login-on-alumni-website/#respond Tue, 13 Dec 2022 06:20:54 +0000 https://tracking.fivebranches.edu/?p=8346 There had been hundreds or even thousands of failed login records found in very short period of time. Worse yet, the usernames used in the failed logins are mostly, if not all, registered usernames. More stringent rules were then applied to limit the attempts to login, such as login lock out feature, change of login ... Read more

The post Resolve the high volume of “Failed Login” on Alumni website appeared first on FBU Tracking & Knowledge Base.

]]>

There had been hundreds or even thousands of failed login records found in very short period of time.

Worse yet, the usernames used in the failed logins are mostly, if not all, registered usernames.

More stringent rules were then applied to limit the attempts to login,

such as login lock out feature, change of login page, limit access of REST APIs, etc.

The “Failed Login Record” is now dropped to practically zero.

The post Resolve the high volume of “Failed Login” on Alumni website appeared first on FBU Tracking & Knowledge Base.

]]> https://tracking.fivebranches.edu/website-design/resolve-the-high-volume-of-failed-login-on-alumni-website/feed/ 0 Fix the “Failed Login logs” overgrown issue https://tracking.fivebranches.edu/plugin/fix-the-failed-login-logs-overgrown-issue/ https://tracking.fivebranches.edu/plugin/fix-the-failed-login-logs-overgrown-issue/#respond Mon, 05 Sep 2022 17:46:19 +0000 https://tracking.fivebranches.edu/?p=7857 With the security plugin installed, the feature of logging “failed login” is running all the time. Due to the settings of current login on fbu site, every login, either by valid user or by hacker, is considered failed. So every login is recorded in the “failed login” log. As a result, the total records, as ... Read more

The post Fix the “Failed Login logs” overgrown issue appeared first on FBU Tracking & Knowledge Base.

]]>

With the security plugin installed, the feature of logging “failed login” is running all the time.

Due to the settings of current login on fbu site, every login, either by valid user or by hacker, is considered failed. So every login is recorded in the “failed login” log.

As a result, the total records, as of 9/4/2022,  were 2,119,337

And it was way much higher than the security plugin can handle. So the “Failed Login Records” could not be displayed in the plugin’s UI.

The huge number of records not just prevents the security plugin function properly on displaying the failed login records, but also prohibits some functions of phpMyAdmin. So it was not possible to delete the failed login records in batch.

At the end the SSH connection to the server was used to delete in batch records of old logs.

And the total records were dropped to only around 3,000

After cleaning, the security plugin can now display the failed logs normally.

With the properly shown “failed login” records, it can be tracked how serious the website is with the attempted hacks.

And need to keep an eye on the record number. Remove old records when the number is going too high.

fbu dot EDU site, “wp_aiowps_failed_logins” table size before and after removing old records

 rec #table size
Before2,119,337114.7 MB
After3,089188 KB

fbu dot ORG site, “wp_aiowps_failed_logins” table size before and after removing old records

 rec #table size
Before1,073,44760.9 MB
After1,19970.8 KB
No show before slimming down
Show records properly after slimmed down

“Failed Login Records” displays properly after the log table is slimmed down to the acceptable size.

The post Fix the “Failed Login logs” overgrown issue appeared first on FBU Tracking & Knowledge Base.

]]> https://tracking.fivebranches.edu/plugin/fix-the-failed-login-logs-overgrown-issue/feed/ 0 Resolve the infected dedicated server https://tracking.fivebranches.edu/web-servers/resolve-the-infected-dedicated-server/ https://tracking.fivebranches.edu/web-servers/resolve-the-infected-dedicated-server/#respond Fri, 22 Jul 2022 21:06:45 +0000 https://tracking.fivebranches.edu/?p=7469 It was found on 7/22/2022 Friday morning, the access to dev site was denied. Later on, it was found not just the dev site, but other sites that are hosted on the same dedicated server were also infected. After going through extensive scanning and cleaning on existing sites files, all sites now are running as ... Read more

The post Resolve the infected dedicated server appeared first on FBU Tracking & Knowledge Base.

]]> It was found on 7/22/2022 Friday morning, the access to dev site was denied. Later on, it was found not just the dev site, but other sites that are hosted on the same dedicated server were also infected.

After going through extensive scanning and cleaning on existing sites files, all sites now are running as expected.

The post Resolve the infected dedicated server appeared first on FBU Tracking & Knowledge Base.

]]> https://tracking.fivebranches.edu/web-servers/resolve-the-infected-dedicated-server/feed/ 0