DDOS Attact Please Help Me

[winteruk]

hi i have a file storage server but all the time when i have about 1500 request in apache server getting down i don't know it about DDOS or cpu load i have dual core 6300 on server i don't know really about linux server i try to limit the user how cant have download more than 1 file in same time but i couldn't find any option in WHM Is any one can help me over here?

[bmcpanel]

hi i have a file storage server but all the time when i have about 1500 request in apache server getting down i don't know it about DDOS or cpu load i have dual core 6300 on server i don't know really about linux server i try to limit the user how cant have download more than 1 file in same time but i couldn't find any option in WHM Is any one can help me over here?

Not sure what your problem is exactly, but, if you are a victim of a DOS attack, then view your logs in

/var/log
/usr/local/apache/logs
/usr/local/cpanel/logs

and locate the offending IP. Once you find the offender, run the following at the ssh command line....

/sbin/route add -host 255.12.255.12 reject

whereas "255.12.255.12" is the offending IP.

Of course, if you have a firewall, you may also block the IP there.

[winteruk]

I Don't Have Firewall Can U Please Recommend Some Good Firewall which Can Limit the apache as well.

[mickalo]

I Don't Have Firewall Can U Please Recommend Some Good Firewall which Can Limit the apache as well.

do a search on "firewall" and you'll get about 500+ hits ... search box is your friend.

Mickalo

[voidsecurity]

I Don't Have Firewall Can U Please Recommend Some Good Firewall which Can Limit the apache as well.

Hello,

Try installing APF and BFD


Best Regards

[winteruk]

Thanks Guys

[brianoz]

Hello,

Try installing APF and BFD

Don't install APF and BFD, they are years out of date and BFD is a little unstable and will probably cause you problems.

Instead, install the up-to-date and regularly maintained CSF from www.configserver.com/cp/csf.html - it includes a WHM interface and can be auto-updated, and is a lot smarter at detecting problems than BFD.

[AndyReed]

Don't install APF and BFD, they are years out of date and BFD is a little unstable and will probably cause you problems.

I am not sure why you always insist on this? APF and BFD are still good firewall-related applications. In addition, what makes you say that "BFD is a little unstable"? Remember that APF and/or BFD, like many other applications, are NOT 100% compatible with every server.

[brianoz]

APF + BFD are fantastic, and were complete ground breakers at the time they were done, but haven't been maintained for 18 months or so (even the website seems to be down a lot). In the past I had problems with BFD and had to disable it - it was blocking things incorrectly and caused several other problems. I've also heard that Ryan has stated he thinks BFD is unstable. Again, these were great in their day, many kudos to Ryan for the great ideas in them and a first implementation.

I like the configserver firewall because:

1. it can be very easily updated (csf -u, or from WHM)
2. it has a WHM interface - and it runs particularly well on cpanel machines
3. it is cautious about what it blocks and can ignore current users (ie those who have used POP recently)
4. it has an active current maintainer, who is responsive when bugs are encountered
5. it runs on nearly all server based Linuxes - Redhat most, RHE, Centos, Debian sarge, Ubuntu, Fedora Core v1-6, OpenSuse 10 - notable exception being FreeBSD
6. it checks for many, many more security red flags than does the older BFD
7. it prevents a number of flood/DOS situations, and by default blocks the worst of the worst spammers (DSHIELD and Spamhaus DROP)

Having said all that, I guess if you were running a different control panel there might conceivably be a reason to consider APF instead, but I'd need persuading. In this case, this is a post in the cpanel forums and CSF is optimized around cpanel so it'd be crazy not to run it -- unless you had FreeBSD I guess.

Am I missing something? (I could well be, no sarcasm intended, I'm half asleep as I write!)

[serversphere]

The APF vs CSF debate is taking away from the OP's problem. winteruk - did you get your problem solved?

[bmcpanel]

Don't install APF and BFD, they are years out of date and BFD is a little unstable and will probably cause you problems.

Instead, install the up-to-date and regularly maintained CSF from www.configserver.com/cp/csf.html - it includes a WHM interface and can be auto-updated, and is a lot smarter at detecting problems than BFD.

I have also had a better experience with CSF firewall by Chirpy (APF/BFD had high resource usage). In fact, I recently hired a company to manage two of my cpanel servers and they suggested an APF install. I turned them down and told them to keep the CSR firewall active.

Anyway, winturk, how are things coming?

[AndyReed]

Am I missing something? (I could well be, no sarcasm intended, I'm half asleep as I write!)

I think we are missing the point, and the the concept of Linux firewalling. Bart Eers wrote a very good article about Basic Firewall functionality and I encourage every body to read it before they jump to any conclusion about a software firewall: http://www.linuxexposed.com/index.ph...=111&Itemid=54

Bart contends, "No matter how complex the firewall is, in its most simple form, a firewall allows and disallows access to specific services based on host addresses, networks, or other such trigger criteria.

If the services that you want to allow or disallow access to are running on a server connected to a trusted network or LAN, you can use either TCP wrappers or iptables to set up your local server-side service access control (personal firewall). That said, TCP wrappers is really not considered to be a true hardened firewall grade form of access control because incoming data is allowed past the networking stack into what's called user space. This is where many Internet worms and attacks are launched to strike, and this in turn means that you can still be cracked if your TCP wrappers-based system is attacked with a known TCP wrappers exploit. Armed with this knowledge, if you have a single server on an untrusted network or directly on the Internet and you wish to run a serious single host-based firewall configuration, iptables should be your only real choice for a real firewall."

Hope this helps!

[IPSecureNetwork]

If the problem its a real DDoS attack. all the linux or windows firewalls doesnt works, you will need a phisical firewall added in your DataCenter, or you must ask to your provider about firewalls with DDoS prevention services.

i will recommend you 2 excelents providers against DDoS attacks.

IPSecurenetwork.com
and Sharktech.net

the best protection against DDoS attacks.

you will need more than a firewall by soft .. belive me .. if someone want attack you ... the load average created by your local firewall will be block the entire CPU .. thats why all the best providers have a datacenter with DDoS protections by Hardware.

I hope this help you.

Best Regards.

[ramprage]

I have an excellent custom script that protects from DDoS attacks. It recently stopped a nasty attack to one of my clients. The server was basically dead, some IPs had over 4,000 + connections and they were flooding all ports. Once the solution was setup and configured, the attackers were fended off and you could actually get to their websites again.

[IPSecureNetwork]

ramprage ... i dont think one single script can stop any kind of real ddos attack... is not a mistery ... the only way to deal with ddos attacks is with a hard firewall and a good good Bandwidht... no other way ... even if the attack is stopped in your box.. a real ddos attack will consume all the bandwidth and your box will disappear from the internet anyway.. think that...