..::LINUX-GUIDE::..

Security

ID #1106

First aid for DDOS attack on port 80

We can use the following steps to recover our server from a DDOS attack on the port 80. To do this you must have logged into the server as a root user.

Step 1 : Install/Configure APF firewall

a) If there are no firewalls installed on the server please install the same,
you will get the steps and directions from the following site.

http://www.webhostgear.com/61.html

b) Turn on the antidos option (USE_AD) in the APF conf file

# vi /etc/apf/conf.apf

USE_AD = 1

Step 2 : Install/Configure mod_evasive (for Apache 1.3x)

mod_evasive and mod_dosevasive are the same

a) Install mod_evasive

# wget http://www.zdziarski.com/projects/mo..._1.10.1.tar.gz
# tar -xzvf mod_evasive_1.10.1.tar.gz
# cd mod_evasive

# /usr/local/apache/bin/apxs -i -a -c mod_evasive.c
# /etc/init.d/httpd restart

b) Also include the following lines in the apache conf file

# vi /usr/local/apache/conf/httpd.conf

-------------------------------------------------
<IfModule mod_evasive.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
</IfModule>
-------------------------------------------------

c) Restart the webserver

# /etc/init.d/httpd restart

Step 3 : Install mod_security

Normally we can find/install this module from WHM
WHM >> cPanel >> Addon Modules >> Select "modsecurity " >>save

Step 4 : Blocking IPs

a) Find the IPs those have established a connection with the server

(The following command is the better one to get the IPs, as this will sort the IPs
according to the number of connections).

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

b) Block them using IPTABLES

# iptables -I INPUT -s 218.92.207.28 -j DROP
# service iptables save
# service iptables restart

c) Block them on APF too

# vi /etc/apf/deny_hosts.rules
<Add the IPs at the end>

# service apf restart

Step 5 : Optimizing the httpd.conf file

# vi /usr/local/apache/conf/httpd.conf

Change the bellow options as follows, original values are shown in the
bracket.

MaxKeepAliveRequests 50 (100)
KeepAliveTimeout 60 (30)

Also edit the following options too, according to the situation.

Timeout
KeepAliv
MinSpareServers
MaxSpareServers
MaxClients

Step 6 : Install/Configure 3rd party DDOS prevention tools

We can also use the most trusting 3rd party script 'DDoS-Deflate' for preventing DDOS attack effectively.
Steps to install this script are as follows.

# wget http://www.inetbase.com/scripts/ddos/install.sh
# sh install.sh

Add the script '/usr/local/ddos/ddos.sh' to cron as follows

# crontab -e

*/5 * * * * /usr/local/ddos/ddos.sh >/dev/null 2>&1

Step 7 : Suspend websites

Check the bandwidth usage of all the domains and suspend the high bandwidth consuming domains for a while

PERMANENT WAY TO FIX THE DDOS ATTACK

As we all know the softwares have its own limitations for preventing against DDOS attack, we can follow these steps to cure it permanently.

1. Ask the NOC for attaching Cisco Guard on the server for 24 hours
(Normally this service is free from most NOCs)

2. Attach a hardware firewall for the server

Hope this will help you in such a situation :-)

Letzte Änderung des Artikels: 2007-07-03 00:11
Verfasser des Artikels: Alen
Revision: 1.0

Artikel ausdrucken

Es ist möglich diesen Artikel kommentieren

Kommentar von wow gold (2009-01-09 05:42:38):
Bucks' Bogut sits out with back spasms Posted Jan 3 2009 6:52PM CHARLOTTE, N.wow goldC -- (AP) -- Milwaukee Bucks center Andrew Bogut did not dress for Saturday night'swow gold game against Charlotte due to lower back spasms. Bogut's back was bothering wow goldhim a night earlier against wow gold the Bobcats, when he was held wow goldto two points and five rebounds in 26 minutes. That was wellwow gold below his season average of 11.5wow gold points and a team-best 10.5 rebounds. "He got through it last night and helped us win the game, but itwow gold got stiff on him this morning," said coach Scott Skiles, whowow gold started Dan Gadzuric in his place. The Bucks did have backup point guard Ramon wow goldSessions available after he missed Friday's game with wow goldflu-like symptoms.

Kommentar von wangli (2009-04-29 10:00:50):
Pakistan's military wow goldsays troops

Kommentar von a242329548 (2009-07-20 03:38:06):
MY wow power leveling BUY wow gold good wow power leveling buy wow gold my wow power leveling cheap wow gold cheap wow power leveling buy wow gold

Kommentar von jK (2009-08-02 18:56:14):
I like buying Kamagra

Kommentar von BGG (2009-08-14 06:16:19):
When it comeslouboutin shoes to the time here,christian louboutin shoes Brack saidchristian louboutinthat Blizzard haslouboutin shoes discount begun anlouboutin shoesinternal discussionlouboutin shoe sale of theSale christian louboutin next World ofBuy christian louboutin Store Warcraft information

Kommentar von NHH (2009-08-14 06:19:35):
Remains aed hardy caps frequently mentioned ed hardy shirtsproblem,ed hardy women we draw a Tiffany jewellersline to theTiffany jewelryWorld oftiffany silver WarcraftTiffany Bracelet Brack success. Tiffany EarringsHis answer Tiffany ringsis: "In ray ban sunglassesfact, we aviator sunglassesdevelop a ray ban wayfarernew game ray ban aviatortime willghd want to 'Oh, ifghd we are to haveghd hair straighteners one million users, ghd straightenersthen weghd hair iron have succeeded.'ghd hair curls We are theghd definition ofghd hair straighteners success is more than oneghd straighteners million users.ghd hair iron Today, we ghd hair curlshave more ray ban sunglassesthan 10 times ray ban aviator sunglassesthe number of users,ray ban sunglasses store which forced our company and team to make some changes. Oh, come this way, we actually have some shame. "

Navigation

TOP 10

Die fünf neuesten Artikel:

Security

First aid for DDOS attack on port 80