The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

DDoS attack

Discussion in 'Security' started by Zion Ahead, Oct 28, 2009.

  1. Zion Ahead

    Zion Ahead Well-Known Member

    Joined:
    Nov 10, 2006
    Messages:
    347
    Likes Received:
    0
    Trophy Points:
    16
    Two nights in a row I had to reboot the server.

    I checked /var/log/messages and found this right before reboot, where the server was pinging on/off and load was high.

    Is this a ddos attack?


    **

    Oct 28 02:52:22 server kernel: Firewall:
     
  2. Zion Ahead

    Zion Ahead Well-Known Member

    Joined:
    Nov 10, 2006
    Messages:
    347
    Likes Received:
    0
    Trophy Points:
    16
    Anyone please?
     
  3. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,450
    Likes Received:
    195
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    I don't want to make light of this, someone else will comment hopefully with better advice too, I'm sure, but I see this sort of thing often in my logs. If you suspect it's an attack that's causing huge loads on the server, contact your provider for assistance, or hire an expert. Don't go it alone wondering what if...

    Some reading here:
    WWW Security FAQ: Securing Against Denial of Service Attacks

    Do you have CSF installed and configured to block permanantly, attacking IPs?

    Checking var/log/messages isn't the best way to go I don't think.
     
  4. ericgregory

    ericgregory Well-Known Member
    PartnerNOC

    Joined:
    Nov 27, 2002
    Messages:
    124
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Pennsylvania
    cPanel Access Level:
    DataCenter Provider
    I second what InfoPro stated. If you believe your server is getting DoS'd you should contact the datacenter that houses it to ask them to evaluate the situation. It's not something that you should mess around with and wonder about :)
     
  5. Spiral

    Spiral BANNED

    Joined:
    Jun 24, 2005
    Messages:
    2,023
    Likes Received:
    7
    Trophy Points:
    0
    Yes does look like an attack ...

    You should take a deeper look at that and given that someone is interested in your server, you may want to also do a full review of your current security and make sure you are properly secured and hardened.

    I certainly would be glad to give you a hand with that :)

    "Death to Hackers" comes only slightly after "Death to Stupidity"
     
  6. Spiral

    Spiral BANNED

    Joined:
    Jun 24, 2005
    Messages:
    2,023
    Likes Received:
    7
    Trophy Points:
    0
    Your data center may be able to filter out the false traffic at their routers before it reaches your server and this might help you get better grips on this thing.

    Beyond that you probably want to thoroughly review the security on your server and make sure you are up to par where you should be.
     
Loading...

Share This Page