Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite

How can I prep up my website infrastructure running on an EC2 instance against DOS attacks? I run apache with nginx as reverse proxy

share|improve this question

5 Answers

up vote 5 down vote

You can't prevent DOS attacks, you can only mitigate them.

  • Keep a small attack surface. Turn off services you aren't using, block access to ports that only need to be accessed from specific locations, make sure your daemons have sensible defaults about how many threads they run and how to behave when system resources run low.
  • Monitor traffic. Know when an attack starts because you got a notice about the traffic or resource load spike. Notice when your ssh daemons or other secure ports get scanned. Notice repetitive patterns of requests. Be able and ready analyze them in depth when things go haywire, but keep a pulse on things all the time.
  • Dodge or block whatever traffic makes up an attack as soon as possible. Figure out a way to fingerprint the attack and throttle those types of requests down. Prioritize services, shot off low priority ones if you have to. Hunker down and serve everything from a CDN until the coast is clear.
share|improve this answer
up vote 3 down vote

First off, you need to distinguish between "Denial of Service (DoS)" attack and "Distributed Denial of Service (DDoS)" attacks.

Since your question is about DoS, you generally protect against DoS attacks by:

  • Keeping your operating system, web servers, mail servers etc updated, so that there aren't any well known remote DoS attacks against the underlying OS & services.

  • Performing a security audit of your own webapp code, and having secure development practices in place for your own webapp code. You want to be sure that there aren't any remote crash / remote resource starvation / buffer overflow / etc attacks against your own webapp code.

  • Have a small "attack surface" as Caleb mentions. Have as few services responding to Internet traffic as possible. Have a firewall in place with a default deny all rule, and only open up needed ports (Amazon EC2's "Security Groups" can do this for you).

There is an almost unlimited number of things you can do to raise security against DoS attacks. The real trick is to make a sound judgement on what you should do. My above list is a reasonable starting point, but you can learn much more about this topic if you want. Security.stackexchange.com is not a bad place to start.

share|improve this answer
up vote 1 down vote

I've been considering using CloudFlare for this. All trafic is routed through them and they watch for malicious requests and block them. The main selling point is that because they are in the business of watching for bad traffic from various sources they can identify potential threats before you'd be able to do so by yourself.

It seems to be a very cost effective alternative to setting up your own infrastructure, but I'm not sure whether routing all my traffic through a third party will slow things down.

share|improve this answer
up vote 0 down vote

You probably cannot protect fully against DDoS, and the best approach would be to cut DDoS attackers as close to source as possible. I don't know many products that does it, but one free is described in this article.

share|improve this answer
up vote -3 down vote

Protecting against DDoS/DoS attacks on a a third party infrastructure such as EC2 is a lost cause. The single EC2 instance will not be able to handle any sort of attack.

If you are serious about your business, I would advise getting in touch with providers that can proxy-filter your traffic to the actual destination:

For example: http://www.gigenet.com/ddos-protection.html

share|improve this answer
1  
It's not a lost cause, EC2 is flexible and there are actually lots of ways to deal with attackes. EC2 has several infrastructure pieces including ways of creating proxies, load balancers, etc. If you have productive solutions, feel free to post them but don't disparage systems that you don't have first hand knowledge of the possibilities. – Caleb Jun 22 '11 at 10:24
First hand knowledge? Flexible infrastructure does not mean anything; you can throw 1000 EC2 instances and dozen of load balancers at it and with high enough PPS rate you will either run out of money or resources. Unless your provider is specifically tailored to mitigate attacks this is a lost cause, end of story. Layer of proxy protection such as Gigenet and others offers is ideal solution in this case. Perhaps taking your own advise would be ideal in this case. – Aleksey Korzun Jun 22 '11 at 15:11
2  
The network of sites that I work on was attacked by a DDoS and our provider put anacustom EC2 instance in front of our server and acted as a reverse proxy. Worked like a charm apart from the extra latency from servers being further away. – Stoosh Jun 23 '11 at 6:18
There is a wide range of technical aspects when it comes to DDoS; if you are on the end of a very weak attack that can obviously work I'm not arguing that. If you are receiving attack large enough to take one EC2 instance out, and bring another one on.. yes that will work. Point is, rather then bandaging the problem and adding new instances when you already experienced down time it's better to simply use a provider that can do this for you 24/7 via a proxy layer. If your instance was hit by some of the attacks I saw, I can guarantee you that no reverse proxy would save you. – Aleksey Korzun Jun 23 '11 at 16:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.