-2

The site is a simple penny auction site.

The site runs on:

  • MySQL
  • PHP

At any given time:

  • an auction can have 100 - 2000 concurrent users.
  • each user has one single "long poll" running in the background that keeps their display updated
  • a user can open multiple windows, increasing the number of "long poll" requests to how many ever windows they have open

It's safe to say that a user should:

  • Never have more than about 3 to 5 windows open
  • Never request pages, images or basically do any get requests too frequently
  • Never call the long poll update function more than once a second per window (at most, but due to the logic, usually far less)

Based on the above what would you recommend to stop any Denial of Service attacks?

So far, when it comes to Denial of Service, I'm aware of the following:

  1. mod_qos
  2. mod_evasive
  3. mod_antiloris

Which would you recommend and why? Or is perhaps a combination necessary?

With caching I'm already making use of MemCache, but is there perhaps caching I can enable on a web server level? The goal is to bring the load on the server down to an absolute minimal, which means even users requesting images or css files repeatedly should be stopped?

Ideally I want a user that abuses the set of rules I create to get a 403 forbidden response which must have a tailored page which tells him why he is temporarily banned. Which also means that if a user breaks these rules, he must not be permanently banned, but rather be blocked for 10 minutes.

Also, one of my biggest concerns is per-IP blocking. Technically I could create a block on a PHP level, but if several users have the same IP, as is the case with a university or office block, how can I stop the group from being blocked if one guy is breaking the rules? The inverse is also true: what if one guy manages to get thousands of IPs and hit the server as hard as he can... how do I detect that?

Any advice on how to do this would be greatly appreciated!

7
  • Have you already experienced an attack? Or do you just have capacity problems? Apr 2, 2013 at 18:14
  • That sounds like going backwards. :) But I suppose if it works... Apr 2, 2013 at 18:20
  • I KNEW someone was going to say that. Haha. There are business reasons for moving away from the java backend. Apr 2, 2013 at 18:21
  • Java backend? I thought it was MySQL and PHP :) Apr 2, 2013 at 18:23
  • It WAS java, now it's going to be MySQL and PHP. Apr 2, 2013 at 18:28

1 Answer 1

1

I would suggest using ModSecurity:

http://www.modsecurity.org/

Here is an example of using it for DOS protection:

http://blog.cherouvim.com/simple-dos-protection-with-mod_security/

I would high recommend you install in a test environment and test first, as sometimes depending on the application you will have false positive matches which you then may need to customize the rules.

Not the answer you're looking for? Browse other questions tagged .