Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any standard way to prevent shared web servers from being abused? I run a CPanel box with a few people on it, and I get the occasional person that decides to use it to DoS other websites. My current 'detection' involves looking at Munin graphs for traffic spikes, then poking around on the machine until I find the cause.

Is there any software out there to detect attacks as they happen?

I run the following: LMD - Clanscan

These do an okay job of detecting your standard C99 shell, or commonly used DoS scripts, but it doesn't detect any sort of custom stuff.

share|improve this question
Time to get a better class of client. – John Gardeniers Dec 15 '10 at 2:38
Seriously, if you have a contractual agreement with them you can take a non-technical vector and either approach the hosting provider and see if they will suspend their account for violating their TOS (which a DDoS hopefully does). If you're in control, well, rm -r /home/offending_user ;) – msanford Dec 17 '10 at 2:26
Before I can rm -rf them, I have to know they are abusing stuff. I am the hosting provider in this case. Dealing with them once I find them is the easy part. – devicenull Dec 17 '10 at 3:01
up vote 3 down vote accepted

I think you're looking for an Intrusion Detection System (IDS), or maybe an Intrusion Prevention System (IPS). Have you looked at Snort?

share|improve this answer
My understanding was that IDS/IPS was mainly focused on inbound traffic. The box isn't actually being compromised, people are voluntarily uploading scripts that run DoS attacks. – devicenull Dec 15 '10 at 2:42
You can do both ingress and egress filtering. – JakeRobinson Dec 15 '10 at 5:26

CSF/LFD ( are fantastic (and free!) and work great with cPanel boxes. It also works just fine on non-cPanel boxes.

Takes less than 5 minutes to setup on your existing box. Tweak the defaults for your environment and it'll automatically block IPs and/or kill processes that go beyond the bounds you set, and send you an email of what it did.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.