Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 2.5.9
PHP version: 5.3.22
MySQL version: 5.0.96 community
Host: (optional, but it helps us help you)
Admin Tools version: (unknown)

Description of my issue:

After upgrading our server from PHP 5.2.9 to 5.3.22 and subsequently upgrading Admin Tools and Akeeba Backup, we are now getting security alerts from 127.0.0.1 and auto blocking on i think all sites. 

I don't believe any of Admin Tools setting have been changed. The server is a managed VDE and as far as I know no access originates from 127.0.0.1.

Just wondering if this normal?

Thanks

Nicholas,

Thanks for the quick response. I suspect that it is not a reverse proxy as I have had the server for several years and have never been advised of it. Also prior to the upgrade of PHP this was not happening. Also I am still seeing security alerts generated by external IPs.

Also I presume that if this was the case and 127.0.0.1 was getting blocked than that would effectively block all incoming traffic. The websites are certainly available to IPs others than the whitelisted IPs. If interested you can see teasme.com.au.

It appears that Admin Query String is the detected behaviour.

I will raise this issue with the host as well, what/ where are the best logs to provide to the host to review.  Any other advice you might have would be appreciated.

Thanks

Raoul

Nicholas

Not sure if it is related but:

At approximately 1206pm on the 9th i recevied 2 emails from www.yourbabycanread.com.au Admin Tools. Saying that someone had tried to login with incorrect details. This happens regularly and is not generally concerning however I recevied these emails in Spanish. This has never happened before.

Both login attemps apparently originated from 60.241.234.98 and tried to login with the Username: brad2512hotmail.com.

Interestingly I have just checked the Security Exceptions Log and Auto IP Block list on several sites and there has not been any blocked activity from 127.0.0.1 since 08/03/13. Most of the target URLs are related to akeeba products. Screenshots attached.

My host has asked:

May I know how does the admin-tools web-application-firewall identifies the suspect behavior ? Can we activate any debugging mode for this firewall? Does it check only with the administrator login link or the exact database query triggered to login to the administrator area?

I ask this because, the database connection string used on your website to connect to the database is:

Host: localhost
Db name:
Db user:
Db password:

Every time a database string is triggered it is through the "localhost" connection. The firewall may be detecting this connection as source of attack.

Thanks