Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The site is a simple penny auction site.

The site runs on:

  • MySQL
  • PHP

At any given time:

  • an auction can have 100 - 2000 concurrent users.
  • each user has one single "long poll" running in the background that keeps their display updated
  • a user can open multiple windows, increasing the number of "long poll" requests to how many ever windows they have open

It's safe to say that a user should:

  • Never have more than about 3 to 5 windows open
  • Never request pages, images or basically do any get requests too frequently
  • Never call the long poll update function more than once a second per window (at most, but due to the logic, usually far less)

Based on the above what would you recommend to stop any Denial of Service attacks?

So far, when it comes to Denial of Service, I'm aware of the following:

  1. mod_qos
  2. mod_evasive
  3. mod_antiloris

Which would you recommend and why? Or is perhaps a combination necessary?

With caching I'm already making use of MemCache, but is there perhaps caching I can enable on a web server level? The goal is to bring the load on the server down to an absolute minimal, which means even users requesting images or css files repeatedly should be stopped?

Ideally I want a user that abuses the set of rules I create to get a 403 forbidden response which must have a tailored page which tells him why he is temporarily banned. Which also means that if a user breaks these rules, he must not be permanently banned, but rather be blocked for 10 minutes.

Also, one of my biggest concerns is per-IP blocking. Technically I could create a block on a PHP level, but if several users have the same IP, as is the case with a university or office block, how can I stop the group from being blocked if one guy is breaking the rules? The inverse is also true: what if one guy manages to get thousands of IPs and hit the server as hard as he can... how do I detect that?

Any advice on how to do this would be greatly appreciated!

share|improve this question

closed as off topic by Wesley, MadHatter, phoebus, mdpc, Smudge Apr 2 '13 at 20:51

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Have you already experienced an attack? Or do you just have capacity problems? – Michael Hampton Apr 2 '13 at 18:14
That sounds like going backwards. :) But I suppose if it works... – Michael Hampton Apr 2 '13 at 18:20
I KNEW someone was going to say that. Haha. There are business reasons for moving away from the java backend. – coderama Apr 2 '13 at 18:21
Java backend? I thought it was MySQL and PHP :) – Michael Hampton Apr 2 '13 at 18:23
It WAS java, now it's going to be MySQL and PHP. – coderama Apr 2 '13 at 18:28
up vote 1 down vote accepted

I would suggest using ModSecurity:

Here is an example of using it for DOS protection:

I would high recommend you install in a test environment and test first, as sometimes depending on the application you will have false positive matches which you then may need to customize the rules.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.