July 2020 - Arch-mirrors - lists.archlinux.org

[arch-mirrors] Arch Linux mirror server with IPv6 ready
by Syaiful Rizal (Diskominfo Papua) 09 Aug '20

09 Aug '20

Hello, I installed Arch Linux public mirror server with IPv6 ready IPv4: 103.100.247.59 IPv6: 2405:bc0:8000:247::59 HTTP: http://mirror.papua.go.id/archlinux/ HTTPS: https://mirror.papua.go.id/archlinux/ RSYNC: rsync://mirror.papua.go.id/archlinux/ Bandwidth: 1 Gbps Location: Jakarta, Indonesia Owner: Pemerintah Provinsi Papua Owner URL: https://www.papua.go.id Thank you, -- Syaiful Rizal

2 1

[arch-mirrors] New Arch Linux Mirror mirror.gi.co.id
by Wahyu Wijanarko 09 Aug '20

09 Aug '20

Dear, We just setup Arch Linux mirror server in Indonesia HTTP: http://mirror.gi.co.id/archlinux/ HTTPs: https://mirror.gi.co.id/archlinux/ RSYNC: rsync://mirror.gi.co.id/archlinux/ Bandwidth: 1 Gbps Location: Indonesia, Jakarta Sponsor: PT Global Intermedia Nusantara Sponsor URL: https://www.gi.co.id Best regards, -- *Wahyu Wijanarko* Business Development Manager - PT Global Intermedia Nusantara Jl. Taman Siswa No. 125 Yogyakarta 55151 Telp. +62-274-382238 Fax. +62-274-379492 http://www.gi.co.id http://wahyu.com

2 1

[arch-mirrors] kitchensink_auth failed for mirrors.kernel.org
by Konstantin Ryabitsev 08 Jul '20

08 Jul '20

Hello: It seems that we're unable to rsync from the following location any more: rsync://kernelorg@rsync.archlinux.org/kitchensink_auth The error we get back is: @ERROR: auth failed on module kitchensink_auth If this is no longer the proper way to authenticate, then please let me know so we can fix our mirror. Best regards, -K

2 1

[arch-mirrors] Huge traffic from China
by Johannes Findeisen 02 Jul '20

02 Jul '20

Hello, I am driving the mirror arch.unixpeople.org. Since some months I encounter a lot of traffic from China which seems to be like a DDoS. I fixed this some month ago by blocking all IP address ranges from China. This stopped the traffic. Yesterday I tried to remove all my firewall rules and to see what happens... Just some hours ago the DDoS startet again so I really had to block China from my mirror again because it would become a fulltime job to monitor my host. While all this happened I tried to figure out what's going on and saw endless downloads of the arch .iso file from many many IP addresses in China. When the download from one IP had finished the download directly started again from exactly the same IP in an endless loop. Does anyone other here encounter such things? Regards Johannes

5 8

Re: [arch-mirrors] Huge traffic from China (services)
by Ave 02 Jul '20

02 Jul '20

We're having this too. ave@owobox:/home/ave $ sudo grep iso /var/log/nginx/access.log | awk '{ print $1 }' | sort -n | uniq -c | sort -nr | grep 27.221.66 29 27.221.66.139 27 27.221.66.136 26 27.221.66.137 26 27.221.66.133 25 27.221.66.134 24 27.221.66.144 23 27.221.66.148 21 27.221.66.143 21 27.221.66.138 21 27.221.66.132 20 27.221.66.141 18 27.221.66.147 17 27.221.66.153 16 27.221.66.151 16 27.221.66.146 16 27.221.66.142 16 27.221.66.131 15 27.221.66.149 13 27.221.66.154 13 27.221.66.152 They all seem to be trying to fetch "/iso/2020.02.01/archlinux-2020.02.01-x86_64.iso" and "/iso/2020.03.01/archlinux-2020.03.01-x86_64.iso", which are 404 on our end. UA for all is "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3". I personally blocked the /24 (sudo ufw insert 1 deny from 27.221.66.0/24 to any). The behavior seems like it's not in good faith (the requests have 30s-4m between them), and while I don't think much will happen, but I'll be filing an IP abuse notice to china unicom about this (hqs-ipabuse(a)chinaunicom.cn) On 7/2/20 3:00 PM, arch-mirrors-request(a)archlinux.org wrote: > Send arch-mirrors mailing list submissions to > arch-mirrors(a)archlinux.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.archlinux.org/listinfo/arch-mirrors > or, via email, send a message with subject or body 'help' to > arch-mirrors-request(a)archlinux.org > > You can reach the person managing the list at > arch-mirrors-owner(a)archlinux.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of arch-mirrors digest..." > > > Today's Topics: > > 1. Re: Huge traffic from China (services) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 2 Jul 2020 09:06:05 +0200 > From: services <services+mirrors(a)eric.ovh> > To: arch-mirrors(a)archlinux.org > Subject: Re: [arch-mirrors] Huge traffic from China > Message-ID: <7066fda6-b2f2-b1b9-90fd-ef257920ee72(a)eric.ovh> > Content-Type: text/plain; charset=utf-8; format=flowed > > Ip is on same range for me > > and found 4 new ip yesterday on another range (scan 22H CEST) : > 119.176.61.18 > 119.176.61.22 > 119.176.61.16 > 119.176.61.12 > > > On 7/2/2020 8:25 AM, Siyuan Miao wrote: >> We also received lots requests from 27.221.66.0/24 >> <http://27.221.66.0/24>. >> >> aveline@mirror-iad01-a:~# sudo grep iso >> /var/log/nginx/mirrors.access.log | awk '{ print $1 }' | sort -n | >> uniq -c | sort -nr >> ? ? 178 27.221.66.133 >> ? ? 176 27.221.66.144 >> ? ? 163 27.221.66.143 >> ? ? 163 27.221.66.132 >> ? ? 158 27.221.66.138 >> ? ? 155 27.221.66.141 >> ? ? 153 27.221.66.131 >> ? ? 150 27.221.66.149 >> ? ? 144 27.221.66.147 >> ? ? 137 27.221.66.142 >> ? ? 136 27.221.66.136 >> ? ? 136 27.221.49.135 >> ? ? 133 27.221.66.154 >> ? ? 133 27.221.66.134 >> ? ? 131 27.221.66.151 >> ? ? 131 27.221.66.146 >> ? ? 130 27.221.66.137 >> ? ? 124 27.221.66.139 >> ? ? 120 27.221.66.153 >> ? ? 102 27.221.66.148 >> ? ? ?93 27.221.66.152 >> >> On Thu, Jul 2, 2020 at 2:14 PM mirror-admin <mirror-admin(a)labkom.id >> <mailto:mirror-admin@labkom.id>> wrote: >> >> Hi, >> >> we got request from fraction of subnet 27.221.66.0/24 >> <http://27.221.66.0/24> >> >> thx >> >> On 7/2/2020 12:52, services via arch-mirrors wrote: >> >> > Hello, >> > >> > Same case here. >> > >> > Impact is low here (via one ip only), because a file which don't >> exist >> > (old iso) : >> > arch//iso/2020.03.01/archlinux-2020.03.01-x86_64.iso" failed (2: No >> > such file or directory) >> > >> > Can you share ip on the list for compare and block all ip before >> ddos ? >> > >> > Regards, >> > Eric. >> > >> > On 7/2/2020 5:02 AM, mirror-admin wrote: >> >> Hello, >> >> >> >> Yes, we notice same download pattern from china IP. Not only for >> >> Archlinux, but for other archive as well. >> >> >> >> What we do is try to be nice, we throttling down our upload >> speed to >> >> their IP. >> >> >> >> Thx >> >> >> >> On 7/2/2020 09:49, Johannes Findeisen wrote: >> >>> Hello, >> >>> >> >>> I am driving the mirror arch.unixpeople.org >> <http://arch.unixpeople.org>. Since some months I >> >>> encounter a lot of traffic from China which seems to be like a >> DDoS. I >> >>> fixed this some month ago by blocking all IP address ranges >> from China. >> >>> This stopped the traffic. Yesterday I tried to remove all my >> firewall >> >>> rules and to see what happens... Just some hours ago the DDoS >> startet >> >>> again so I really had to block China from my mirror again >> because it >> >>> would become a fulltime job to monitor my host. >> >>> >> >>> While all this happened I tried to figure out what's going on >> and saw >> >>> endless downloads of the arch .iso file from many many IP >> addresses in >> >>> China. When the download from one IP had finished the download >> directly >> >>> started again from exactly the same IP in an endless loop. >> >>> >> >>> Does anyone other here encounter such things? >> >>> >> >>> Regards >> >>> >> >>> Johannes >> > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > arch-mirrors mailing list > arch-mirrors(a)archlinux.org > https://lists.archlinux.org/listinfo/arch-mirrors > > > ------------------------------ > > End of arch-mirrors Digest, Vol 98, Issue 2 > ******************************************* -- -Ave https://ave.zone

3 2