Vps account overloading

[alexo]

Hello

I have VPS account and my account is overloaded last 3-4 days.
i get few emails from Cpanel

------
This is cPanel stats runner on host.*****.net!
While processing the log files for user mydrugn, the cpu has been
maxed out for more than a 6 hour period. The current load/uptime line on the server at the time of
this email is
15:13:28 up 40 days, 3:24, 0 users, load average: 13.20, 12.81, 12.60
You should check the server to see why the load is so high and take
steps to lower the load. If you want stats to continue to run even with a high load; Edit
/var/cpanel/cpanel.config and change extracpus to a number larger then 0 (run
/usr/local/cpanel/startup afterwards to pickup the changes).

check Main >> Server Status >> CPU/Memory/MySQL Usage

and view that starting 04.06.2006 (everyday) somebody is eating my server resources

op Process %CPU 68.4 proftpd: ftp - 216.55.162.181: anonymous/[email protected]: IDLE
Top Process %CPU 68.0 proftpd: ftp - 216.55.162.181: anonymous/[email protected]: IDLE
Top Process %CPU 67.9 proftpd: ftp - 216.55.162.181: anonymous/[email protected]: IDLE

i don't give anybody anonymous access and don't have such user

few questions
1. what is proftpd , why it can cause server overloading
2. what do you think, clossing access from this ip can resolve problem?

thank you

 

[obvio]

Who is your web host and have you contacted them about this problem?

 

[Camron]

If you just read the email, cPanel is practically begging to you

The user "mydrugn" is using all your resorces. Suspend him and wait 2-3 hours. See if your server unloads.

Thanks,
Camron

 

[theparrot]

The link to the user mydrugn is just saying that is the site who has the logs being read. It does not mean they are the resource users, and suspending them would be an unfair reaction to that message... as a host you should know better.

proftp is the ftp daemon, you should try filtering that ip, and killing those processes.
It seems someone has gotten anon ftp going on your server, so you are probably being used a spam/warze/crackz host, so you want to track that down and close it.

 

[alexo]

first of all mydrugn is my main host on this vps account.
there isn't any site hosted. it's only main root account.

It seems someone has gotten anon ftp going on your server, so you are probably being used a spam/warze/crackz host, so you want to track that down and close it.

as all sites in my vps account are mine, i know that i don't give anybody any access (even anon).
i disabled anon access via WHM and will try to check server load

 

[theparrot]

first of all mydrugn is my main host on this vps account.
there isn't any site hosted. it's only main root account.



as all sites in my vps account are mine, i know that i don't give anybody any access (even anon).
i disabled anon access via WHM and will try to check server load

depending on how they got it going, you may need to use shell level control to undo it, not whm. so beware that whm may or may not have really turned it off.

 

[Camron]

Well,
As a host I have never got this message as our servers are monitored 24/7 by techs. I am just the owner, not a tech.

Thanks,
Camron

 

[Chronos]

In my experience I have seen cpanel making tons of useless logs... useless from the point of view that they are not rotated or deleted like Plesk does and cannot be eliminated throgh the Cpanel interface even if you are the root admin.

You need to contact support if your VPS is managed or have technical assistance, otherwise login as root but using SSH to dolownload, delete, and instruct the server to rotate the logs every X days.

Through Cpanel Forums you can get further assistance on this matter.

 

[scribby]

First off I wouldnt even use proftpd.. use pure-ftpd the update is easy via WHM.

Under WHM look for..
Service Configuration>>
FTP Configuration

Look for the Anonymous Ftp part and disable it.

There should be a button that says switch to pure-ftpd.

 

[alexo]

Look for the Anonymous Ftp part and disable it.

I did it and now server load is fine.

thank you

the question is how some1 get this access or try to do this ?

 

[scribby]

They would of logged on as Anonymous to your ftp... and most likely uploaded like crazy.

 

[localpub]

They would of logged on as Anonymous to your ftp... and most likely uploaded like crazy.

It looks now you have a nice collection of warez on your server for your personal use...

:hehe: