Search found 1538 matches

by palinka
2020-02-21 17:16
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Let me see, a rule per day is too much and will not be easy to manage. On my side, I will check also on the limits It's super easy to manage. It just causes problems when the rule count grows. Note to self: learn to read.... :roll: I just noticed you wrote rule per DAY (for some reason I read "IP p...
by palinka
2020-02-21 14:33
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-21 14:28
According to this thread and another one, 1000 IPs maybe a good compromise
https://superuser.com/questions/802355/ ... 534#804534
There's no limit to how high i can jump up into the sky... :roll:
by palinka
2020-02-21 14:32
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-21 14:24
Let me see, a rule per day is too much and will not be easy to manage. On my side, I will check also on the limits
It's super easy to manage. It just causes problems when the rule count grows.
by palinka
2020-02-21 14:16
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Also maybe this evening, I will share a new version of hmsConsolidateRules.ps1. The new vesrion will - create 1 rule per month add all IPs of everyday in this rule So the name will be for ex 2020-02, 2020-03...... There will be a check if the rule exists so ip will be added Ok but just make sure yo...
by palinka
2020-02-21 02:11
Forum: Scripting
Topic: Firewall Ban
Replies: 143
Views: 15238

Re: Firewall Ban

Latest updates: * MSSQL support * Added IP map (works great on mobile too!) * Added new table for fast queries of certain firewall blocks data - old table queries become slow with several hundred thousand rows. I'm working on a solution to kill off that table altogether, but for now, the web admin i...
by palinka
2020-02-21 02:01
Forum: SpamAssassin implementation discussions
Topic: SA Forwarding
Replies: 11
Views: 356

Re: SA Forwarding

Are you sure your test message is getting marked as spam? Is the sender or recipient whitelisted?
by palinka
2020-02-21 01:43
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

I forgot to tell about 1 note I have noted earlier, Please also update the script for the creation of the hm_fwban table (it gets created with 1) BEGIN CREATE TABLE hm_fwban ( ID int IDENTITY(1,1) NOT NULL PRIMARY KEY, ipaddress varchar NOT NULL, timestamp datetime NOT NULL, ban_reason varchar(192)...
by palinka
2020-02-20 01:21
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, I have an issue with the 1st graph, it displays the number of ips correctly but the date is 1 month in advance. You can see a snapshot at http://salam.hd.free.fr/combined.jpg If I am not mistaken, it is this query that populates it which returns 18 February, 4 ipperday but the graph says M...
by palinka
2020-02-20 01:18
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Very quickly, Does the following meets your expectation SELECT DATEADD(ww, DATEDIFF(ww,0,GETDATE()), 0) AS week_beginning, year(CAST(DATEADD(ww, DATEDIFF(ww,0,GETDATE()), 0) AS DATE)) AS [Year], month(CAST(DATEADD(ww, DATEDIFF(ww,0,GETDATE()), 0) AS DATE)) AS [Month], day(CAST(DATEADD(ww, DATEDIFF(...
by palinka
2020-02-19 16:03
Forum: General discussions
Topic: Cleaning up huge inbox
Replies: 4
Views: 514

Re: Cleaning up huge inbox

I had to move a very large mailbox a couple of times. Thunderbird choked the first time. Then, several months later, Thunderbird worked flawlessly. The difference? The first try was using Thunderbird portable. The second was the regular windows installer version. I don't know why, but it made a hug...
by palinka
2020-02-19 15:02
Forum: General discussions
Topic: Cleaning up huge inbox
Replies: 4
Views: 514

Re: Cleaning up huge inbox

I have a user with at least 200K messages in her inbox. Yes, 200 thousand. She is OK with moving all of these out into different folders, but the sheer volume poses a problem. Thunderbird and Outlook can't reliably handle this many emails. Frankly, Outlook 2010 chokes after a couple thousand. Is th...
by palinka
2020-02-19 14:50
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

I just pushed a bug fix commit to GitHub. Sorry for late response as I went to bed early yesterday as I have meetings the whole day today. Oh my god, I spent à lot of time yesterday updating some small things but it took some time. Can you tell me what was the update, then I will give it a go.I wil...
by palinka
2020-02-19 14:46
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

FROM_DAYS(TO_DAYS(timestamp) -MOD(TO_DAYS(timestamp) -1, 7)) AS week_beginning, DATE_FORMAT(FROM_DAYS(TO_DAYS(timestamp) -MOD(TO_DAYS(timestamp) -1, 7)), '%Y') AS year, (DATE_FORMAT(FROM_DAYS(TO_DAYS(timestamp) -MOD(TO_DAYS(timestamp) -1, 7)), '%c') - 1) AS month, Can you share for each statement t...
by palinka
2020-02-18 23:46
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

I just pushed a bug fix commit to GitHub. You should replace all powershell files (except config.ps1) and all php files (except config.php). There are still a few things to do, but we're closing in on perfection. And since you're a mssql guru, I have a working query that outputs weekly instead of da...
by palinka
2020-02-18 23:14
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

This should do it: If ($Limit -eq 0){ Exit } ElseIf ($Limit -eq 1){ $ConsRules = "$ConsFolder\hMS FWBan "+$BanDate+".csv" $Query = " SELECT ipaddress FROM hm_fwban WHERE $(DBCastDateTimeFieldAsDate('timestamp')) LIKE '$BanDate%' AND flag IS NULL ORDER BY timestamp DESC $(DBLimitRowsWithOffset $($N *...
by palinka
2020-02-18 22:59
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Run hmsConsolidateRules.ps1 at 12:01 am daily. Before scheduling, I debugged this file, I was sure that there was no record was entered yesterday and the query returned nothing by the code continued 400 loops even though there were no record to export to csv file, so it created 400 empty csv file I...
by palinka
2020-02-18 22:53
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Ok I will do. I was browsing the index source as one of the sql statements caujhgt my attention as it seemed to me is not returning any result SELECT DBFormatDate(DBCastDateTimeFieldAsDate('MIN(lasttimestamp)'), '%M %D, %Y')." AS mindate, COUNT(ipaddress) AS countip, SUM(hits) AS counthits FROM hm_...
by palinka
2020-02-18 19:54
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Ok got it, still I need your help for this question Last question , I still have rule created for each IP, I thought that new version allows grouping of IPs, am I right, if yes, how this can be done? Run hmsConsolidateRules.ps1 at 12:01 am daily. All new rules (including rebans and manual bans) are...
by palinka
2020-02-18 19:13
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

I agree and the tool is working perfectly and as I said earlier, very good ideas behind it useful for any serious admin, I really congratulate you for the work you have done. I completely agree with you when things start small very basic for 1 need then starts to grow step by step.... I am not so v...
by palinka
2020-02-18 18:22
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Its worth mentioning that it might be a good idea to start a new github with last version and start maybe making the code more robust from sql perspective instead of IFs everywhere. Forexample, thinking loudly, using a session flag in PS or the we, put sql code in file and mysql code in another fil...
by palinka
2020-02-18 16:44
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

It looks like everything is working for you now. I see your only bans are IDS at the moment. You can ban anything for any reason you want. That's the beauty of the eventhandlers fwban function. For example, if you decide you simply don't like facebook and instagram, just ban them. strRegEx = "facebo...
by palinka
2020-02-18 16:34
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

That was on search.php, also on repeats-view.php I get the same thing 7 IPs repeatedly dropped at firewall matching "2020-02". (Page: 1 of 1) Last Hit IP Address Reason Country FB 20-02-18 10:53:40 92.154.95.236 IDS France 1 20-02-18 10:40:05 185.36.81.78 IDS Republic of Lithuania 1 20-02-17 18:18:...
by palinka
2020-02-18 16:18
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Isn't GROUP BY syntax the same for MySQL and MSSQL? Anyway, that's a remnant from when I was querying hm_fwban_rh. I'll remove it even though it shouldn't hurt anything. You can group a single return value as well as multiple ones. No it is not possible with sql, here is the error that you get Msg ...
by palinka
2020-02-18 16:17
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

There's an issue with that. Maybe you can suggest a solution. Some links on repeats.php send date=YYYY-DD only, which is to search repeats-view.php by month. This works fine in MySQL but I think maybe that would error out in sqlsrv? Can you try it? Go to repeats.php and click one of the "This Year'...
by palinka
2020-02-18 16:16
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

So in this case there will be no records in the other 2 ytables if it is enetered by VBS then processed and deleted by ban script, am i correct? Correct. Eventhandlers.vbs will add and delete ids entries all day long until a connection fails to send a message or logon, in which case it will simply ...
by palinka
2020-02-18 16:13
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Comment on error and see if it produces an error log entry. I did , there was no error logged in hmailserver I stopped/restarted hMailServer and it is working now and I got an entry in the hm-ids table with hit = 1 Ah... OK I understand. The ids functions use hmailserver's built in sql execution. h...
by palinka
2020-02-18 16:08
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

some new issues I discovered this morning 1 - This cant run in sql, I commented GROUP BY ipaddress in order to make it work SELECT hits AS returnhits, ipaddress FROM hm_fwban_blocks_ip -- GROUP BY ipaddress Isn't GROUP BY syntax the same for MySQL and MSSQL? Anyway, that's a remnant from when I was...
by palinka
2020-02-18 15:54
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, please, you did not respond to one of my questions I asked yesterday when running the hmsFirewallBan.ps1 but not inserting any record in hm-ids table, the script works fine now and it inserts records in 2 tables but not hm-ids table, here is the question again. Did I misunderstand somethin...
by palinka
2020-02-18 15:52
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

OK, I will check and let you know, lets assume everything working fine and we have a record inserted in hm-ids table, then the ps script runs in 5 minutes, find a record in this table with more than 2 hits, it creates the rule then delete the record from it without any record for the IP in the 2 ta...
by palinka
2020-02-18 14:16
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, can you please tell me how to trace what is happening in the VBS file. In hmailserver log I see "TCPIP" 5768 "2020-02-18 11:24:23.963" "TCP - 87.245.132.52 connected to 192.168.1.34:25." "DEBUG" 5768 "2020-02-18 11:24:23.963" "Executing event OnClientConnect" "DEBUG" 5768 "2020-02-18 11:24...
by palinka
2020-02-18 14:14
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-18 14:12
Yes agre understood this, please see my precedent email, in spite of failure nothing is logged, in VBS I saw you always do
On error resume next
and on error goto 0
but no writing to a log file or ...
Comment on error and see if it produces an error log entry.
by palinka
2020-02-18 14:13
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Also, do you have an error log?
by palinka
2020-02-18 14:09
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, can you please tell me how to trace what is happening in the VBS file. In hmailserver log I see "TCPIP" 5768 "2020-02-18 11:24:23.963" "TCP - 87.245.132.52 connected to 192.168.1.34:25." "DEBUG" 5768 "2020-02-18 11:24:23.963" "Executing event OnClientConnect" "DEBUG" 5768 "2020-02-18 11:24...
by palinka
2020-02-18 14:08
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-18 13:31
OK, I replaced the whole code in commoncode, it is working now
You should replace ALL powershell files. Just to be sure.
by palinka
2020-02-18 14:02
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, can you please let me know which part inserts records in the hm_ids table? VBS in hmailserver or the powershell script "hmsFirewallBan.ps1"? EventHandlers.vbs Functions Function idsAddIP(sIPAddress) Include("C:\Program Files (x86)\hMailServer\Events\VbsJson.vbs") Dim ReturnCode, Json, oGeo...
by palinka
2020-02-18 02:15
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

FORMAT(CAST(timestamp AS DATE), 'System.Collections.Hashtable[%Y]' , 'en-US') AS year, (FORMAT(CAST(timestamp AS DATE), 'System.Collections.Hashtable[%c]' , 'en-US') ) AS month, FORMAT(CAST(timestamp AS DATE), 'System.Collections.Hashtable[%e]' , 'en-US') AS day, Something is wrong on your end. I j...
by palinka
2020-02-18 02:10
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-18 02:00
in hmsFirewallBan.ps1 there is no code to populate ids table
Yes. The table gets populated by hmailserver eventhandlers.vbs.

Powershell only deletes entries due to either expiration or because an IP got up to 3 tries within the interval, triggering a ban.
by palinka
2020-02-18 01:56
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

In scriptm hits per daym it generates a sql query SELECT a.daily, a.year, a.month, a.day, a.ipperday, b.blockperday FROM ( SELECT CAST(timestamp AS DATE) AS daily, FORMAT(CAST(timestamp AS DATE), [b]'System.Collections.Hashtable[%Y]'[/b], 'en-US') AS year, (FORMAT(CAST(timestamp AS DATE), [b]'Syste...
by palinka
2020-02-18 01:35
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Here you records in hm_fwban_blocks_ip and hm_fwban_rh tqbles but nothing in hm_ids. In section ####################################### # # # IDS # # (Intrusion Detection System) # # # ####################################### you query hm_ids as follows $Query = "SELECT ipaddress, country FROM hm_id...
by palinka
2020-02-17 23:21
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-17 23:07
OK please let me know once it is done as nothing is getting to my tables not from the PS ban script nor the hMailserver VBS
How is that any different than before you learned of this project? :wink:

I just pushed another commit on top of the other changes lcamilo did.
by palinka
2020-02-17 23:08
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

This should be really dealt with differently. Did your freind helping you talked about it? $FirewallLogObjects | foreach-object { If (($_.Action -match 'DROP') -and ($_.DestinationPort -match $MailPorts) -and ($_.SourceIP -notmatch $LSRegex)) { $IP = $_.SourceIP $DateTime = $_.Date + " " + $_.Time ...
by palinka
2020-02-17 22:39
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Speak of the devil... He just put in a pull request for a bunch of things including this query: $Query = "IF NOT EXISTS (SELECT 1 FROM hm_fwban_blocks_ip WHERE ipaddress='$ipaddress') INSERT INTO hm_fwban_blocks_ip (ipaddress, hits, lasttimestamp) VALUES ('$ipaddress',1,'$timestamp') ELSE UPDATE hm_...
by palinka
2020-02-17 22:21
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Panilka, in hmsFirewallBan.ps1 section $Query = "INSERT INTO hm_fwban_blocks_ip (ipaddress, hits, lasttimestamp) VALUES ('$IP',1,'$DateTime') ON DUPLICATE KEY UPDATE hits=(hits+1),lasttimestamp='$DateTime';" This doesn't work in sql as you use a specific extnesion to mysql which allows the use of O...
by palinka
2020-02-17 20:31
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

OK thanks for both answers, I will continue discovering the tool If you reload your old hm_fwban_rh table with the old structure and data ==> then run hmsRetroAddBlocksIPTable.ps1, it will do the table upgrade for you. You will need to modify the CREATE statements because they are written for MySQL...
by palinka
2020-02-17 20:01
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-17 17:46
I solved the strange issue, the file was blocked, I unblocked it
Any reason this specific security on this file?
I think GitHub just transfers text without any file attributes. Must be something on your end. Nothing is blocked on my system.
by palinka
2020-02-17 19:54
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

I dumped the data in the tables before starting from scratch, Altered columns in hm_fwban_rh mean your data won't line up correctly. Before: id=autoincrement. Now:id matches id on hm_fwban_blocks_ip where ipaddress is the same. In other words, the altered table accepts duplicates while the old tabl...
by palinka
2020-02-17 19:18
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-17 18:43
Do you want me to share the updated 2 files which are working fine now with you?
Post it here in forum code block.
by palinka
2020-02-17 17:30
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Excuse me! It was my fault! : oops: I don't think I tested it correctly or didn't understand how this search should work, perhaps because my data mass was too small and I didn't pay the necessary attention. I will correct this and send a receipt request as soon as possible. WHERE timestamp LIKE '%{...
by palinka
2020-02-17 16:58
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

There's a new user variable in Config.ps1. You should start from scratch. I'm warning you now. I won't be able to help much if you're mixing and matching files and database tables without understanding the reason why they're there in the first place. Also, every upgrade should be a complete upgrade....
by palinka
2020-02-17 16:05
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, it is the same exact code that I have for creating the tables, only 3 tables and 1 function, here is the copy from Githyub, no new table and ptr field is already there, github says the file was updated 6 days ago If ($DatabaseType -eq "MSSQL") { # Create hm_fwban table if it doesn't exist ...
by palinka
2020-02-17 14:06
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Just start from scratch. Trust me.

Db creation is in hmsFirewallBanDBSetup.ps1.

I'll try to update the installation instruction today.
by palinka
2020-02-17 02:43
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Palinka, Clicking on "IDS" link. I find 2 records 1 with 8 hits. Did you set up a scheduled task to run hmsFirewallBan.ps1 every 5 minutes? If you did not, you need to. If you did, then the last 6 hits came within the last 5 minute interval. How can I ban the one with 8 hits from web site? Or it sh...
by palinka
2020-02-17 02:08
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-17 02:06
I will stop now, go to bed, time to sleep, my wife shouting :D
I will continue tomorrow. Tell me where are based, in Europe or US?
US and A....
by palinka
2020-02-17 02:08
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

search was returning nothing, I fixed it. in sql server "Like operator" does not work with columns of type Datetime, it should be converted to a string, I replaced the line WHERE timestamp LIKE '%{$search}%' by WHERE (convert(nvarchar(50), timestamp, 126) LIKE '%{$search}%' or CONVERT(VARCHAR, Date...
by palinka
2020-02-17 00:54
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

OK cool.

Today I uploaded a "major" change to github. I suggest starting from scratch since there is a new database table plus one altered table. There's no point in trying to use the upgrade scripts when you have very little data and you never really got started with it anyway.
by palinka
2020-02-16 21:20
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Yes the demo is working fine I should say that it is very nice and useful, we see good ideas behind the desihgner :wink: I activated debug on the php.ini, now I can this error Parse error: syntax error, unexpected '$pdo' (T_VARIABLE), expecting ',' or ';' in C:\inetpub\wwwroot\PHPBanAdmin\functions...
by palinka
2020-02-16 15:46
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

eliassal wrote:
2020-02-16 15:42
Also can you please provide a link or info on learning google charts that you are using?
Just go to the Google charts pages. They have examples. That's how I worked it out.

Honestly, I think it would be a lot easier to just fix php/SQL.
by palinka
2020-02-16 15:43
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Oops. I accidentally copied .htaccess there. I just deleted it but give it a minute - I just restarted for windows update.
by palinka
2020-02-16 15:29
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

No a standalone server. Palinka, I am thinking of creating your phpbam in ASP.Net/C#. Can you provide me screenshots of the php ban pages, also if possible the rules to follow in the functions in a bullteted list I have a demo at http://hmsfirewallbandemo.ddns.net/ Everything works except for actua...
by palinka
2020-02-16 15:25
Forum: General discussions
Topic: Block IPs
Replies: 184
Views: 5451

Re: Block IPs

Can't you just upgrade php?