Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am sorry. I have no understanding in server. I am getting tired of ddoses from one person.

Basically I am asking how I can make a cron job that does:

 netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

And if an IP has more than 100 connections.

Do:

iptables -A INPUT -s *ipaddress here* -j DROP

And then

/etc/init.d/apache2 restart

How can I do this in debian and doing this cron every minute 15. My first problem is, how can I read the results from the first command and then make a if statement?

Thanks in advance.

share|improve this question

closed as not constructive by womble, Tim Brigham, EEAA, Ward, Lucas Kauffman Jul 23 '12 at 6:08

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
We're not here to do your job for you. What have you tried so far? –  womble Jul 22 '12 at 8:13
    
@womble Of course, I have a website. I have no idea how to maintain it. My first question would be is this even possible. I followed tutorials on how to block the ip and how to find it. But cron job seem more advanced. –  Alice Jul 22 '12 at 8:21
    
This site is intended for professional systems administrators to ask questions of their professional colleagues. If you have no idea how to maintain a website, it is likely that this site is not the appropriate one for you, and you should perhaps engage the services of a consultant. –  womble Jul 22 '12 at 8:24
    
@womble I've had my site running for 3 years fine. And I want to learn how to. that's why I am asking. Are you saying this is a wrong place to learn for me? –  Alice Jul 22 '12 at 8:26
4  
Yes, I believe it is. –  womble Jul 22 '12 at 8:46

1 Answer 1

I have to say, I think womble's advice is excellent. Normally, one learns before accepting responsibility for production resources, and if you haven't, then get ready to pay for professional assistance when you run into trouble. Learning on the job is a good and normal part of sysadmin life, but not starting from scratch. Most people here are happy to help someone who, having come thus far, needs to learn that next step that they can't quite grasp, but are less keen to spend their valuable time spoon-feeding people who seem incapable of learning (or unwilling to learn) on their own.

That said, what you want to do isn't necessarily stupid. I wouldn't do it by dynamically modifying the firewall ruleset, since the chance of DOSsing yourself is high. I probably would look into the connlimit module of iptables, which allows you to match on the number of parallel connections for each client IP address. Perhaps something like

iptables -I INPUT 1 -m connlimit  --connlimit-above 99 -p tcp --dport 80 -j REJECT

would do what you want. You will definitely want to be aware that order in iptables rules matters (first-dispositive-match-wins), and that restarting apache after changing the iptables ruleset is almost completely pointless.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.