Gray list - database
Forum
  1. Forums
  2. Imunify360
  3. Imunify360 and Imunify Sensor
  1. Morten
  2. Friday, 10 March 2017
  3.  Subscribe via email
When checking the gray list I see alot of ip's and I just installed IM360.
Are all these gray listed on other Imunify360 servers and imported to our installation? If one IP on that gray list does remove themselves, are that IP populated to other Imunify360 servers and removed from the grey list?

Edit: http://docs.imunify360.com/terminology.htm
"Agent continuously negotiates Gray List with CloudLinux DDoS reputation server to get latest updates regarding graylisted IPs."
-> How often does the agent negotiate with CL server? And if a IP is gray listed on our server, will it be distrubuted to other servers?
Attachments (1)
Rate this post:
  1. 15.03.2017 11:03:28
  2. # 1
Oleksiy S Accepted Answer
Posts: 0
Joined: 17.10.2019
0
Votes
Undo
Hi Morten,

> Are all these gray listed on other Imunify360 servers and imported to our installation?

IPs from pre-populated graylist are those notified on at least two other Imunify agents or honeypots. That is simplified explanation for scoring rules being processed on Imunify central server.

> If one IP on that gray list does remove themselves, are that IP populated to other Imunify360 servers and removed from the grey list?

IP graylist unblock is propagated to other Imunify servers if when user from greylisted IP is unblocked by captcha. Manual graylisted IP edits (via Imunify agent cli) do not propagate to other Imunify servers. At least for now.
  1. 15.03.2017 14:03:11
  2. # 2
Morten Accepted Answer
Posts: 99
Joined: 16.04.2014
0
Votes
Undo
Ok, thanks for your answer :)

IP graylist unblock is propagated to other Imunify servers if when user from greylisted IP is unblocked by captcha
-> How quick those this happend? Will it be propegated at once or is there a cron running once each hour or something?
  1. 15.03.2017 15:03:01
  2. # 3
Oleksiy S Accepted Answer
Posts: 0
Joined: 17.10.2019
0
Votes
Undo
> How quick those this happend? Will it be propegated at once or is there a cron running once each hour or something?

The first option. The feed about raising botnets is delivered immediately.
  • Page :
  • 1


There are no replies made for this post yet.
Be one of the first to reply to this post!
Guest
Submit Your Response
Upload files or images for this discussion by clicking on the upload button below. Supports gif,jpg,png,zip,rar,pdf
• Insert • Remove Upload Files (Maximum File Size: 2 MB)
Captcha
To protect the site from bots and unauthorized scripts, we require that you enter the captcha codes below before posting your question.