[rt-2]

Hi, I woke up to this:

Код:

[30/01/2017 04:18:40] [connection] 93.171.44.1:57260 requests connection cookie.
[30/01/2017 04:18:41] [connection] incoming connection: 93.171.44.1:57260 id: 0
[30/01/2017 04:18:41] [join] Martin_Gudvin has joined the server (0:93.171.44.1)
[30/01/2017 04:18:41] [LOGIN]: Martin_Gudvin(0) needs to register.
[30/01/2017 04:18:48] [TESTING]: Removed 622 buildings for Martin_Gudvin(0)
[30/01/2017 04:18:54] [SERVER]: The time is 4:18
[30/01/2017 04:18:54] [SERVER]: Synchronizing players
[30/01/2017 04:19:10] [LOGIN]: Martin_Gudvin(0) needs to pass the Tutorial.
[30/01/2017 04:19:10] [TUTORIAL]: Starting tutorial for playerid:0
[30/01/2017 04:19:10] [TUTORIAL]: Showing next slide for playerid:0 (slide 0)
[30/01/2017 04:19:10] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:11] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:11] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:11] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:11] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:12] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:12] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:13] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:13] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:13] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:13] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:14] [SERVER]: Martin_Gudvin didn't login.
[30/01/2017 04:19:14] [part] Martin_Gudvin has left the server (0:1)
[30/01/2017 04:19:14] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:14] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:14] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:15] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:15] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:15] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:16] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:16] [SERVER]: The time is 4:19
[30/01/2017 04:19:17] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:18] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:18] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:18] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:19] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:19] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:19] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:20] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:20] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:21] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:21] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:21] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:22] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:22] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:22] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:23] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:23] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:23] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:23] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:24] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:24] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:24] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:25] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:25] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:25] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:26] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:26] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:26] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:27] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:27] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:27] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:28] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:29] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:29] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:29] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:30] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:30] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:30] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:31] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:31] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:31] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:32] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:32] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:32] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:33] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:33] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:33] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:34] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:34] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:34] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:34] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:35] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:36] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:36] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:36] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:36] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:37] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:37] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:37] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:38] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:38] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:38] [SERVER]: The time is 4:19
[30/01/2017 04:19:39] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:39] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:39] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:40] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:40] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:41] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:41] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:41] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:41] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:42] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:42] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:42] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:43] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:43] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:43] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:43] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:44] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:44] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:44] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:45] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:45] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:46] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:46] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:46] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:47] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:47] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:47] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:48] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:48] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:48] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:49] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:49] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:49] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:49] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:50] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:50] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:50] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:51] BAD RCON ATTEMPT BY: 31.28.226.194
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80
[30/01/2017 04:19:51] [debug] AMX backtrace:
[30/01/2017 04:19:51] [debug] Run time error 7: "Stack underflow"
[30/01/2017 04:19:51] [debug]  Stack pointer (STK) is 0x12DA1D84, stack top (STP) is 0x12DA1D80

And after 2 minute of this, the server obviously crashed.

So I have 2 questions, what does "Stack underflow" means, and how to prevent it. There seem to not be much information about this error, I am thinking even maybe it is only from Zeex Compiler, because I have found nothing or almost for "Runtime Error 7".

And also why multiple bad RCON attemps are causing this.

Thank you,
rt-2

[Sew_Sumi]

Quote:

Originally Posted by blinkpnk There seem to not be much information about this error, I am thinking even maybe it is only from Zeex Compiler, because I have found nothing or almost for "Runtime Error 7".

https://sampforum.blast.hk/showthread.php?tid=298511 - Edited as posted wrong link

It's not only from zeex compiler, it's a problem with your code.

As it happens with this bad rcon spam, I'd suggest it has something to do with it.


Are you tracking bad rcon attempts? as that would be something to look towards.

[rt-2]

Quote:

Originally Posted by Sew_Sumi https://sampforum.blast.hk/showthread.php?tid=177114 It's not only from zeex compiler, it's a problem with your code. As it happens with this bad rcon spam, I'd suggest it has something to do with it. Are you tracking bad rcon attempts? as that would be something to look towards.

I read all the link you posted, it's not talking about any "stack underflow" problem so I don't really know why you posted this BUT in fact I have a huge gamemode, my AMX is 75MB.

As for your question, no I am not trackign bad RCON attempts at all, I thought that the server was doing an OK job for blocking them so far, but I might want to if abusing it might crash the server...

Just to be sure, what would be the possible method to track bad RCON attempts? Maybe I do but I don't realize it somehow....

Thank you for your answer,
rt-2

[Sew_Sumi]

Gah, posted wrong link...

https://sampforum.blast.hk/showthread.php?tid=298511


With terms of "tracking" the bad RCON attempts, are you doing anything, such as logging the attempts, or checking whether they came from a player on the server at the time. Anything that's actually being processed when they are doing their bad attempt.

Even via any filterscripts you are using.

[Evocator]

These attempts should be alarming. They are not generated from a player on the server who is failing to login, but from an automated software that is used to crack passwords.
If you do not use this feature (https://sampwiki.blast.hk/wiki/Remote_Console) I personally recommend that you disable it and you never use the RCON functionalities (even on the server) i.e kick everyone who attempts to login.

To disable the (remote) feature: add to your server.cfg file the line "rcon 0". More info: https://sampwiki.blast.hk/wiki/Server.cfg

[Sew_Sumi]

^^ Indeed... Someone is hell bent on trying to get admin on your server.

You must be doing something right.

[SyS]

stack under flow means memory in stack became empty and no more poping is possible afterwards

[rt-2]

Quote:

Originally Posted by Sew_Sumi With terms of "tracking" the bad RCON attempts, are you doing anything, such as logging the attempts, or checking whether they came from a player on the server at the time. Anything that's actually being processed when they are doing their bad attempt. Even via any filterscripts you are using.

In the best of my knowledge I am not.

Quote:

Originally Posted by Ralfie These attempts should be alarming. They are not generated from a player on the server who is failing to login, but from an automated software that is used to crack passwords. If you do not use this feature (https://sampwiki.blast.hk/wiki/Remote_Console) I personally recommend that you disable it and you never use the RCON functionalities (even on the server) i.e kick everyone who attempts to login. To disable the (remote) feature: add to your server.cfg file the line "rcon 0". More info: https://sampwiki.blast.hk/wiki/Server.cfg

I have been working on servers for a long time, if you are not ready to be attacked 24/7, you are not ready to plug your server to the inter-webs my friend. Seriously I am not afraid, my password is not 'password' or '1234' and without saying more I think it's not easy.
Also I am using the RCON to load/unload scripts so I prefer keeping it.

Quote:

Originally Posted by Sreyas stack under flow means memory in stack became empty and no more poping is possible afterwards

That do you mean by 'poping'?

I also read that it should not normally happen?

Quote:

Originally Posted by ****** Actually, I think stack underflows are caused by removing TOO MUCH stuff from the stack, which can't normally happen if you use the compiler. What libraries do you use and do any of them have "#emit" in them? Does this happen only when you call that LoadServer function?

That was in the post Sew_Sumi linked me.

Thank you all for your help and answers,
It only happened once and never happened again.
I did not get attacked again, but I was attacked before and it didn't do this,
I wasn't there at this moment so I cannot know if the memory got full or if the attack was more intense or anything.
It might be a one time thing, but I'm trying to make sure it's not the opposite or at least try to prevent.

Thank you,
rt-2

[SyS]

popping means removing memory blocks from stack.

[rt-2]

It happened again this morning, someone tried to attack the server, and then it went into a loop of "stack underflow".

I will add something to detect and ban when someone do this before the server gets "damaged", but i'd like to better understand and fix this if anyone know something...

Thank all.
rt-2