I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban.
I talked to the people that administer the server and they told me Fail2ban is installed by default to watch for failed SSH login attempts. They asked if I wanted it to watch other services on the server.
What services should I have watched by Fail2ban to protect against the DoS attacks?
Would this just be the HTTP services - watch for multiple requests from the same IP within x amount of time?
One of the attacked appeared to create a lot of connection to the MySQL database with the command sleep
.