Recent content by pleskpanel

We were able to track this down and as much as we wanted it to be a Plesk or CentOS/AlmaLinux problem, it turns out that it was a security endpoint policy with an HTTPS stream inspection that would cause this behavior. Adding an exception fixed it for FTPS transfers!

So it's not a port issue as we've disabled iptables and border firewall traffic restrictions. Hopefully this thread gets the attention of a Plesk staff member!

This was not the fix as it failed again soon after. Not sure what's going on!

This seems to have resolved it however it's unclear what changed or why: https://support.plesk.com/hc/en-us/articles/12377595891991-FTP-connection-is-randomly-dropped-during-file-transfer-on-Plesk-for-Linux-server-with-SELinux

I'm going to bump this thread and add that this has started to happen with large file uploads but exact date when it started isn't clear. It's present on AlmaLinux 8/9 and CentOS 7.

Once you're happy with the matched results, then use the following (replacing the last value with the name of your jail) to commit the changes without having to restart the Fail2Ban service:

And now for the part II - The CPU consuming bots of the world unite! Use at your own risk and note that some bots below are "legitimate" but blocked due to irrelevant traffic:

A great improvement on speed indeed! Just one adjustment to help avoiding matching the URL itself in requests: Without this, if you were blocking a bot called "spot" and you had a page with a referer that contained "spotting-birds-in-the-wild" you could accidentally trigger that just by...

As a quick update to this post, the regex above is a bit too greedy since it would effectively match results in the URL itself. For example, a URL such as "/spot/hello-world/ would be picked up and banned if the "spot" bot was included in the definition list. An updated version that fixes this...

No filesystem issues and the manual approach worked without a problem (no extra steps taken or needed) so we're going to hold off on using this for now in production environments.

Are you able to SSH or login to Plesk while the incidents are occurring or is this an "after hours" type of scenario each time?

Changed the failregex to the following otherwise it would never match user agent names with versions, URLs or anything else after them:

You're not entirely incorrect on this - I had to modify the failregex on the default one for it to work correctly.

The GUI tool failed two installs on AlmaLinux 9.3 with the local gpgkey path not found errors; ended up using the manual upgrade approach which pulls it from MariaDB and worked like a charm: [mariadb] name = MariaDB baseurl = https://dlm.mariadb.com/repo/mariadb-server/10.11/yum/rhel/9/x86_64...

Why not use the new MariaDB upgrade tool?