up vote 2 down vote favorite
share [g+] share [fb]

My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!).

Sample from the access log:

186.92.86.149 - - [30/Nov/2011:09:49:40 -0500] "GET /boards/search.php HTTP/1.0" 404 169 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US)" "-"
187.131.200.33 - - [30/Nov/2011:09:49:40 -0500] "POST /boards/search.php HTTP/1.0" 413 199 "http://rol.ru" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20030105 Phoenix/0.5" "-"
189.72.198.227 - - [30/Nov/2011:09:49:40 -0500] "GET /boards/search.php HTTP/1.0" 500 193 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US)" "-"
101.109.17.136 - - [30/Nov/2011:09:49:40 -0500] "POST /boards/search.php HTTP/1.0" 413 199 "http://gazeta.ru" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC) Opera 6.0 [en]" "-"
186.188.156.111 - - [30/Nov/2011:09:49:40 -0500] "POST /boards/search.php HTTP/1.0" 413 601 "http://rol.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "-"

As they're all trying to access that one page is there a quick and easy way I can set something up to automatically add them to iptables or etc?

link|improve this question
1  
They look like normal clients just accessing a page, have you checked out the referring sites to see why they're linking to you? – sam Nov 30 '11 at 15:17
Those 413 response codes are what make me suspect that this is indeed an attack of some kind. Maybe capture a full request/response to see what's going on. – Shane Madden Nov 30 '11 at 16:09
It's definitely an attack, I have lists of the offending ranges and none of them are legitimate clients (the website is country specific). No reason I'd suddenly have 5000 people from Mexico all trying to request that one page 5 times a second. – Max Dec 3 '11 at 3:24
feedback

2 Answers

up vote 1 down vote accepted

Copy the file somewhere new, then have nginx produce a redirect to that contents new location. This is only a temporary measure but sending 302s from the webserver versus parsing and executing PHP every time will be much much cheaper.

Genuine users browsers should just honour the redirect.

link|improve this answer
Seems like the search page needs a POST - a redirect will cause a new GET, not a resend of the POST. – Shane Madden Nov 30 '11 at 16:05
True, but a genuine request should land on the right duplicate using GET first. Only POSTs mid-flight would be affected, or POSTs from the attacker which wouldnt be of any interest to serve properly anyway. – MIfe Nov 30 '11 at 16:15
Hmm? How would a legitimate request know to POST to the new URL? – Shane Madden Nov 30 '11 at 16:25
Thanks guys! Went for a different solution in the end but this is a cracking idea. – Max Dec 3 '11 at 3:29
feedback
up vote 1 down vote

Fail2Ban may be able to rewrite your rules so it can automatically ban incoming requests to that file. You might also want to work with your upstream provider to block out certain requests (if they can) since this won't keep the DoS from clogging your connection, just reduce their effectiveness slightly. Unless your datacenter has a large connection this will reduce your website's ability to serve legitimate traffic, and your provider upstream may be able to help cut down those requests farther up the pipe.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.