FailBan and OScam

There are 16 replies in this Thread which was already clicked 18,560 times. The last Post () by s3n0.

    • Official Post

    Do you have unwanted visitors on your OScam server?


    You can enable failban function and with this you will be able to ban unwanted clients.


    Open oscam.conf file and under GLOBAL section add these lines:


    Code
    failbancount = 5
failbantime = 1440  —-> [COLOR='#FF0000']this means that client will be banned for 1 day. You can change this.[/COLOR]


    Thats it. Enjoy!

    Yes it do. As per my experience high amount of failban will make your stable unstable or even crash because the server's processing power if stolen by failban application.

    failbancount = 2
    failbantime = 1440 —-> this means that client will be banned for 1 day. You can change this.


    Thats it. Enjoy


    if i put failbancount = 2 what doseit mean this


    Hi,
    I see that this can be added in the global config and all is good, but how can i ban a user for ever and not just a day please.
    regards Talks.


    - - - Updated - - -


    Quote from Talk's

    Hi,
    I see that this can be added in the global config and all is good, but how can i ban a user for ever and not just a day please.
    regards Talks.

    Ok sorted i have been told just to change the >
    failbantime = 1440 —-> this means that client will be banned for 1 day. You can change this.
    now i have this and works >
    failbantime = 0


    cheers.

    Quote from sagher

    I am victim of a IP address who always try to connect with my server and sadly hack my existing user and connect with there IP anonymously.

    what can i do for it?


    Hi.


    There are several ways to block a user. First you need to find out how he broke into your Oscam or which exploit / bug abused. Then focus on this error. There are really many ways to block a user. But you have to write what he uses - which BUG.


    For example, you can try changing the protocol version if it is cccam. You can update Oscam to a new version if you haven't. You can ban an IP address in your router. You can add "hostname =" to the accounts in the "oscam.user" file to specify an exclusive IP / hostname (for each account) - But the problem here will then be dynamically assigned IP addresses. What does this "anonymous" account look like in Oscam's LOG ? Isn't that a problem with a missing "dvbapi" account ? Because this happens often if you forget to set up a dvbapi account while using it (internal connection of Oscam to Oscam as to yourself).


    Of course, the login+password and filter for connection from specific IP addresses to the administrator's WebGUI (Oscam Webif) is also a necessity. This is setting in the "oscam.conf" file. But then you have to use the root password on the machine running your Oscam server.

    I see something like this in LIVE LOG:



    How can I ban these IP addresses from my Oscam server forever or at least for a long time?

    It looks like someone tried to connect from several IP addresses. Either it is a dynamic IP address or it tries to attack from several hosts on the internet.


    You can find out the DNS name of each IP address, for example like this command: nslookup 192.168.1.1 . If they are always the same DNS name... then you can to block this DNS name.


    For now, try to create at least a regular account called anonymous in "oscam.user" and set a very strong password of at least 15-20 characters, also with various special characters (underscore, dash, wrapper, ... ) + with some numbers + with a different letter size.


    If the same IPs are always repeated, then disable them on the firewalls of the router or Linux set top box or, as written above, it can also be disabled in Oscam by IP.


    ---------------------------------------


    The "anonymous" account also shows up with various Oscam errors. Unfortunately, I don't remember exactly which errors. In the case of bugs such as poorly set cascading or reshare. When more than one account is connected at the same time and you have only allowed 1 account (in "oscam.user" file)... the attempt may be reported as a disconnected "anonymous" account. But I really don't know exactly... when this "anonymous" appears with which Oscam bugs.


    ---------------------------------------


    In Linux (in a set-top box) you can also disable groups of IP addresses... you can already find it in Google... but be careful... for example:

    Block range of IP Addresses
    I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am…
    serverfault.com

OSCam Support Forum

Configs, discussion, downloads and guides for OSCam Softcam.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login