Results 1 to 14 of 14
  1. #1
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556

    Question Account suspended, account still being accessed.

    There is an account on my server which had been overloading the CPU. I suspended the account, but when I check apache there are still ips connecting to the site (100-150 ips).
    Anyone know how to stop this or know how they are doing it

    Thanks in advance.

  2. #2
    Join Date
    Apr 2004
    Location
    Australia
    Posts
    456
    I think it may still be possible to access a site while suspend by using http://hostname.com/~username/ but don't quote me on that as I'm not 100% sure.

    If I were you I would backup the account and terminate it, and then to basically unsuspended it you can just restore the backup, at least this way you know 100% they cannot access there site anymore.

  3. #3
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556
    Just checked http://HOSTNAME/~username and the account is suspended. So I don’t know how people are connecting to it.
    I don’t really want to back-up and terminate, so if anyone else has any suggestions let me know. If not, looks like I will have to terminate.

  4. #4
    Join Date
    Apr 2004
    Location
    Australia
    Posts
    456
    Have you restarted Apache to make sure they are not processes just left over after the termination..?

  5. #5
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556
    Yes restarted apache, even stopped it for a few minutes, which did help but the connections came back again!

  6. #6
    Join Date
    Apr 2004
    Location
    Australia
    Posts
    456
    Could comment out the site in the httpd.conf until you wish to unsuspend?

  7. #7
    Did that site per chance have it's own IP address? If so you can drop all inbound to that ip address, as long as no one else is using it.

    Are these 150-200 connections actually causing load on your server though?

  8. #8
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556
    Quote Originally Posted by scribby
    Could comment out the site in the httpd.conf until you wish to unsuspend?
    Good idea, didnt think of that one, will let you know how I get on.

  9. #9
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556
    That did not work, it disabled the suspended page and could be accessed for some reason (after restart).

    The site does not have a dedicated ip.

  10. #10
    Join Date
    Apr 2004
    Location
    Australia
    Posts
    456
    Quote Originally Posted by Excel Hosting UK
    That did not work, it disabled the suspended page and could be accessed for some reason (after restart).

    The site does not have a dedicated ip.
    If it could still be accessed there must be something still directing it to the correct directory, I would be checking that there are not duplicate httpd.conf entry's for the site.

  11. #11
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556
    This is weird, I removed everything apart from the account. I just did a DNS lookup on the domain and its pointing to another server. So why does my apache output say there are ips connecting to the account on the server?

    When I go to http://myip/~useraccount it says account suspended, but there it no entries for the domain on the httpd.conf file, so nothing should come up.

  12. #12
    Join Date
    Apr 2004
    Location
    Australia
    Posts
    456
    Could be that the DNS has not fully updated so some users are still being directed to your server.

    Also I just realized if a site has been suspended its going to still create Apache processes because it has to display the suspended page using Apache?

  13. #13
    Join Date
    Apr 2005
    Location
    Tinterweb
    Posts
    556
    Quote Originally Posted by scribby
    Could be that the DNS has not fully updated so some users are still being directed to your server.

    Also I just realized if a site has been suspended its going to still create Apache processes because it has to display the suspended page using Apache?

    So if I re-activate the account, then remove the apache config it should ok?

  14. #14
    Join Date
    Oct 2004
    Location
    San Francisco, CA
    Posts
    394
    Hey, Excel Hosting UK, please check your PM box.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •