I am looking for ways to help stop DOS attacks. I'm running a linux server and looking for ways i can help limit the effect of any attacks and possibly set some limits on things without affecting anything
migrated from stackoverflow.com Mar 21 '12 at 12:38
This question came from our site for professional and enthusiast programmers.
The by far greatest number of DOS attacks is distributed. A singular DOS attack (e.g. someone running a network load analyzer on his computer over night) can be thwarted by having a low-overhead service and consuming attacker time, for example by delaying responses. Banning an IP address (temporarily!) when too many requests are sent works too, there exist automated tools (e.g. fail2ban) for that.
All that doesn't work for a distributed DOS attack.
The best way to stop a distributed DOS attack is not being the target of one. Most owners of a server will eventually witness or be directly or indirectly be affected by a DOS attack, this just happens. Many of these are only half-assed too (or fully blown, but directed at someone else), and you just wait until it's over, with slightly impaired service.
The second best way is to configure a router high up on the hierarchy (the one that connects the datacenter to the backbone) to drop packets going to the attacked machine. A firewall on the attacked machine or close to it is useless.
All other means are useless as well, because no matter what you do, if someone uses 20 or 30 machines (or 200...) and just physically saturates the wire, there's nothing you can do against it from a software point of view.
There exist some pretty solutions like for example SYN cookies, which can in theory still allow a reduced-quality service in spite of DOS attacks, but these can't help the fact that while the wire is busy, no frames go through. So, given a massive enough attack, your ethernet card never receives any of your packets.
Preventing DOS attacks is more like an art and a work in progress than a simple goto solution. The best way is to start small using common tools, analyze logs and work your way from there.
May I suggest to look at this to get a basic protection up and running: http://blog.lavoie.sl/2012/09/protect-webserver-against-dos-attacks.html