up vote 0 down vote favorite
share [g+] share [fb]

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external databes server IP and about 100 search engine scrapers.

This system was working well for a while until for a yet unknown reason DDos deflate decided to ban 127.0.0.1 out of the blue. This prevented a php-fpm of things from running. I switched FPM to unix socket instead, so if localhost was banned again, it would run fine.

But today out of the blue DDOS deflate banned my external database server. This IP was always whitelisted, and this IP always has well over the set limit of connections, so the whitelisting worked. But today out of the blue, boom also this IP got banned, and was removed from the whitelist.

I am totally freaked out, and have stopped using DDOS deflate for now. What could be causing this? DDOS deflate was successfully banning/unbanning new IP's all the time, and it would honor the whitelist. But once in a while, it just randomly removes items from that whitelist, and bans them.

Maybe someone also knows a good alternative to DDOS deflate? I work with IPTABLES.

link|improve this question
73% accept rate
Do you need DDoS Deflate? If not, why are you running it? – voretaq7♦ Jan 13 at 3:08
Yes, my webserver is often under attack by people, and I want to block heavy scrapers. DDOS deflate does a great job banning people who flood the site. As long as it doesn't ban IP's I have whitelisted.. :'( – FunkyChicken Jan 13 at 3:13
When you say it "removes items from that whitelist", do you mean the actual whitelist file is modified? – David Schwartz Jan 13 at 3:18
Yes, when I manually open /usr/local/ddos/ignore.ip.list the first 2 ip's should be 127.0.0.1 and the 2nd one my DB server's ip. These have both been automatically removed at some point. I have checked all login history/bash history. Nobody else has been on my machine. DDOS deflate uses the whitelist to also ban people. The way this system works is that Banned IP's also get written to the whitelist during the ban. inetbase.com/scripts/ddos/ddos.sh that is the main script. – FunkyChicken Jan 13 at 3:27
Then it sounds like the script is broken. Perhaps it doesn't use proper file locks to prevent concurrent updates from breaking the list. – David Schwartz Jan 13 at 8:17
show 1 more comment
feedback

1 Answer

up vote 0 down vote accepted

I started using https://github.com/ess/citadel which works very well so far.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.