Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I run a proxy server with squid and I've just got a report that a user of mine tried a ddos using my proxy. I can I block such requests? Ex: Allow just max 5 requests on the same domain on the same minute?

LATER EDIT max 5 requests per minute for the same URL

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Probably I could do this usign iptables? –  mazgalici Mar 24 '11 at 9:22
4  
Whatever you do, dont do 5 requests per minute. Learn first waht you talk about. A page open can trigger 30-40 loads IMMEDIATELY for all the pictures. –  TomTom Mar 24 '11 at 9:29
    
I hope that user has been replaced. –  John Gardeniers Mar 24 '11 at 10:55
    
I wanted to say 5 requests per minute for the same URL –  mazgalici Mar 25 '11 at 9:50
    
5 requests per minute for the same URL is too little as well. Our web-application pulls single ajax url about 10 times per ONE minute, and there are many ajax-powered applications that behaves at the same way. –  rvs Mar 25 '11 at 9:54

2 Answers 2

Are you sure it was someone from inside your organization? If your proxy is accessible and usable from the Internet, anyone in the world could be using it to do whatever they please.

If it was indeed one of your users, you should probably take steps to remove their access to your network.

As for the 5 requests per minute: That would make it completely unusable.

share|improve this answer
    
Is password protected, is from my organisation and I know who did it –  mazgalici Mar 25 '11 at 9:50

Use OpenDNS (http://www.opendns.com/) as dns server for your proxy: it has automatic block & detection of botnet and similar problems. Probably you have some kind of infection on the pc we're talking about. With a free account you'd also get the chance to do a nice web filtering and stats work.

Using malwarebyte's antimalware (http://www.malwarebytes.org/mbam.php) + superantipsyware (http://www.superantispyware.com/download.html) solved all my similar problems and both have free version.

If, this could be the other case, the user is aware of trying a ddos attack just talk with him first and then with the boss. Nothing works better than that.

As for the 5 requests per minute: That would make it completely unusable.

I do totally agree, @Hyppy. :)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.