Icecast Streaming Media Server

[davect99]

Running two mount points and I get frequent messages in the error log pertaining to only one of them (2ngtest):
[2010-10-31 09:50:27] WARN fserve/ req for file "./web/2ngtest/index.html" No such file or directory

Any reason why the server might be looking in the web folder for an html file with the name of that mount point? It does not happen with the other mount point.

[karlH]

This is probably down to a botnet that some have experienced before, lots of IPs issuing requests for <mount>/index.html. The ones I've seen have typically come from Germany and have been known to cause a DoS attack with sites with many streams. The fact that you only see one is probably because that is the only one identified so far.

There has been a few ideas to try to resolve this.

One is to run fail2ban against the access log, and ban these IPs for a few hours (some of the ISP cycle IPs so blocking for a very long time may not be the best approach). This can be done against any icecast version and the firewall drops the request. This is probably fine for a few streams but I've noticed problems if you have many streams on icecast getting hit.

In the kh tree I have experimented with a ban-client option to automatically add the IP to the internal icecast banned IP list for a certain amount of time. This works on any platform but it does not interact with the firewall so the incoming client is just dropped at the icecast accept stage, not the firewall. This can be done with

<mount>
<mount-name>/*/index.html</mount-name>
<ban-client>7200</ban-client>
</mount>

You could use auth command/url listener_add to filter the listener based on IP. This will be slower than the previous options but allows for flexibility in processing the IPs and interacting with the firewall.

I was wondering whether extending the ban-client method to run a command such as iptables would be better. That should allow for people running on other platforms interacting with their firewall.

karl.

[davect99]

Forgot to mention I'm running the win32 version of v2.3.2-kh27.1 so I won't be able to use fail2ban (that's Linux only I believe). I'll try the ban-client option.

[davect99]

This doesn't appear to be having any effect...

[karlH]

do you have the <deny-ip> file setting, even if it is an empty file, it still needs to be defined because it uses the same internal cache.

karl.

[davect99]

[karlH]

to an empty file at least, normally it would contain IPs that are always rejected.

karl.

[davect99]

So <deny-ip>./web/deny.txt</deny-ip> should be OK?

[karlH]

assuming that is the path to the file you want then yes. check your error log to make sure the file is accessed

karl.