Well, there’s good news and bad news regarding the intermittent server problems that I’ve been experiencing on with this site and that may have been experienced by a few others.
Now I think the problem has been identified. That’s part of the good news. The bad news is that “identified” does not mean “solved.”
More of the good news. Most of the problems I’ve experienced are probably unique and are different than what regular visitors to iLind.net experience.
It turns out that my problems stem from the implementation of security measures by my hosting service, Hostrocket.com. I guess added security is also generally a good thing, especially since this blog has been previously attacked, and the security is designed to defend against increasingly sophisticated and potential damaging distributed denial of service (“DDoS”) attacks.
Here’s how Webopedia.com explains it.
DDOS is a type of DOS attack where multiple compromised systems — which are usually infected with a Trojan — are used to target a single system causing a Denial of Service (DoS) attack. Victims of a DDoS attack consist of both the end targeted system and all systems maliciously used and controlled by the hacker in the distributed attack.
According to this report on eSecurityPlanet, in a DDoS attack, the incoming traffic flooding the victim originates from many different sources – potentially hundreds of thousands or more. This effectively makes it impossible to stop the attack simply by blocking a single IP address; plus, it is very difficult to distinguish legitimate user traffic from attack traffic when spread across so many points of origin.
And then there’s a relatively recent variant which, I’m told, attacks via an internal WordPress function, XMLRPC. It allows an attacker to try out many potential passwords in a short period of time, unless it is blocked.
So my problem has now been identified. Here’s the most recent response back from tech support staff.
Looks like your ip address was blocked due to your connections exhibiting symptoms of a web attack. The rule that was triggered was the xmlrpc.php rule, which only allows 2 connection attempts from the same ip address, within 10 minutes of each other. I’ve removed the block at this point, but the rule will be triggered again if the connections are made within that time period, as these are often correlated with web attacks.
Of course, it’s extremely hard to administer a blog like this one if logging on to do almost anything is this limited. Since I’m mobile and blog from lots of other places besides home, the static IP address won’t be practical.
So now I’m having to see if HostRocket can come up with a “magic” solution. Certainly I’m not the only blogger getting snagged in their new layers of security.
The bottom line for readers is that you shouldn’t run into this problem, only the routine but occasional periods when the site goes down temporarily.
If any of you tech-savvy folks has an idea that might help, please don’t hesitate to post a comment or contact me directly via email.
