Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to figure out how to protect my server against what it seems to be a botnet (I'm just guessing)

Everyday, more and more IP's fill my application logs with invalid request (eg: GET requests to url's that should be receiving only POST requests)

First I thought about logging all those IP's based on both a) the fact that they are making invalid requests and b) the amount of request per unit of time, and then just run a cron that grabs those ips and adds rules to iptables to drop their packets.

But reading a little about it I found that many problems can arise from this approach:

  • The IPs being banned could be from valid users, who got their PCs infected, and I don't want to ban them for good. Banning them for a day would be enough I think. Is there a way to put expiration on the rules? Or do I have to save a 'base' iptables config, and at the end of the day remove all the rules and reload that base config?
  • The IPs could be totally fake. I didn't know that was possible =s. How do you protect a server against this?
  • Iptables can slow down the server if we add too many rules. Someone mentioned that it was possible to ban ips without adding rules to iptables. Is that possible? Is there a scalable way to ban lots of IPs?

Any thoughts?

share|improve this question
    
I only ban IPs for one hour. Most attacks will move on after a few failed attempts. If they come back, they get banned again. –  barryj May 24 '11 at 8:02
    
IPs cannot be faked for HTTP as the TCP handshake requires acknowledgement of the source IP. With UDP, IPs can be faked. It depends on how you define "faked", proxy servers are considered cheating ;) –  Lekensteyn May 24 '11 at 8:20
    
@barryj okay, good to know. @Lekensteyn =O, great to know. Yes I mean faked faked, I don't care about banning proxies. –  HappyDeveloper May 24 '11 at 8:26
add comment

3 Answers

This is part of the Internet noise which all Internet connected computers experience, unfortunately we don't live in a perfect world. Trying to prevent it is like playing a cat and mouse game. You can use Iptables rate-limiter to limit the number of incoming requests from an IP but thats about it.

Instead insure that your application and OS is secure. Keep up with the security patches whenever possible and follow secure coding guidelines. Also configure the services correctly, one of the biggest security flaw is mis-configured services.

share|improve this answer
add comment

Don't bother with IP banning rules - as you suspected, source IPs can be faked, an automatic ban would just create another denial of service attack vector against your host.

In most cases you can ignore invalid requests - those are worms or automatic scripts blindly trying to exploit security holes which might or might not be there. Hold on to Sameers advice of patching up your system and applications (especially your PHP applications, as they usually are quite erroneous and are exploited frequently). Only act on traffic if it is impacting your server's performance (e.g. a large number of non-legitimate requests is using a lot of your server's resources). Even a plentiful bunch of iptables rules would hardly cause any load with modern hardware.

share|improve this answer
    
Can you provide any information about the source IP being faked for a TCP connection? I realize it's trivial to do for UDP, but I've never seen any information about it being possible in TCP, except for in very specific circumstances. –  devicenull Jun 6 '11 at 3:59
    
Faking the packets is not a problem - no matter if TCP or UDP. The challenge with TCP is guessing the right sequence number. There are types of attack that do not require the sequence number guess - like SYN flood attacks or DoS attacks against simple connection rate limiting like what's implemented using iptables' connlimit (SYN packets don't need a sequence number). Apart from that, there are techniques for a qualified guess of the SN under certain circumstances - there has been some research on that topic –  the-wabbit Jun 6 '11 at 7:45
add comment

If you want to go the IP banning route with iptables, then use fail2ban. It will watch your log files for bad IPs and block them for defined amount of time.

Look at using a layer 7 firewall like mod_security for Apache.

Recently I resolved a bunch of major performance problems for a customer. They had over 7000 iptables rules to blacklist various IPs. Removing these fixed major network performance issues. It seems like iptables can't handle more then a couple thousand rules.

Creating a blackhole route for unwanted hosts probably performs better. This could mean having a lot of extra small routes, but Linux handles that fine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.