45
votes
Accepted
How can I protect SSH?
That's just the normal Internet background noise of people scanning for vulnerable servers.
You can add an iptables rule to rate limit incoming connections (e.g. four in four minutes) for a simple fix ...
- 3,357
25
votes
Is it possible to have a secondary managed DNS provider to quickly delegate to when DDOS attack on our *primary* external DNS provider happens?
First, let's address the question in the title.
Is it possible to have a secondary managed DNS provider to quickly delegate to
"Quick" and "delegation" do not belong in the same sentence together ...
- 33.1k
21
votes
Dealing with NTP reflection attacks in IPTables
Essentially, you're outta luck if the DDoS attack manages to fill whatever pipe you have to the Internet (which is the purpose of any UDP reflection attack -- to fill the pipe). If your upstream link ...
- 97.1k
10
votes
Accepted
many graceful restarts in httpd error log?
okay, i've found the reason , these graceful restarts are happening because of log rotations (crond gracefully restart the http service after log rotation) some logs are getting rotated very ...
- 277
9
votes
How can I protect SSH?
As @Simon Richter mentionned, that's just internet background noise and you shouldn't worry. A few things you have to make sure are that:
You don't allow password-based authentication but only public ...
- 191
7
votes
Accepted
How to prevent DDOS attack impact on Netlify? (downtime + bandwith usage/cost)
Put your server behind a CDN / DDOS protection vendor such as CloudFlare / AWS CloudFront + WAF and ensure that your server only accepts direct connections from your vendor and your own static IP's.
...
- 32.8k
6
votes
Accepted
Is a DDoS possible if the port being attacked is closed?
Yes. Packets destined for your host will still be routed to your machine and your machine still has to process those requests. Even if the 'port is closed', the Kernel/Network Stack still have to ...
- 2,172
5
votes
better alternative for tcp_syncookies in linux
Ubuntu 10.04 has default "sysctl.d/10-network-security.conf" setting below:
# Turn on SYN-flood protections. Starting with 2.6.26, there is no loss
# of TCP functionality/features under normal ...
- 2,690
5
votes
there is empty ips in netstat
Your picking up ipv6 network connections which often have a number of colons in them. The cut command doesnt take this into account when snipping the colons out from the IP address.
Might be more ...
- 23.6k
5
votes
Dealing with NTP reflection attacks in IPTables
I will assume you have a pipe to your ISP which terminates on your own router/firewall. Then behind that router/firewall you have your own machines. The ISP won't block the traffic so you have to deal ...
- 4,296
5
votes
Accepted
How to interpret Firewall logs?
Most of these are pretty obvious abbreviations of the names used for the fields/flags of the IPv4, TCP, and UDP headers.
https://en.wikipedia.org/wiki/IPv4#Header
https://en.wikipedia.org/wiki/...
- 132k
5
votes
Accepted
Is this real google bot or attack? How do I deal with it?
This is exactly the scenario that fail2ban was invented to cover. I suggest you look into that here: https://www.fail2ban.org/wiki/index.php/Main_Page
Likely the "badbots" jail would take care of ...
- 136
5
votes
Accepted
Can I report malicious ip addresses for money?
Short answer - no.
Setting a honeypot server to collect such IPs is easy and cheap and the information quickly becomes stale. Most of the scans come from short lived cloud/vps servers.
Cloud providers ...
- 373
4
votes
I am under DDoS. What can I do?
Change your domain to go to a black hole like 0.0.0.0 for a short period.
Speak to your server provide and see if they can issue you with another IP address as a temporary way to access the server ...
- 320
4
votes
better alternative for tcp_syncookies in linux
Apparently, tcp_syncookies introduces more benefits than disadvantages.
Instead of the typical speculation on random blogs, perhaps we could consult "the source":
With the updates for IPv6 and ...
- 140
4
votes
DDoS mitigation / prevention with nginx
Actually you can use Nginx limit_req
module and also Nginx limit_conn
Both modules are able to limit the connections from a specific source and also to limit requests made from IPs, and this in your ...
- 302
4
votes
How to reroute a DDoS attack to the attacker?
Besides from legal issues, this is not possible technically. DDoS attacks are initiated from too many machines. You can not return that traffic from your single or few server(s).
DDoS attacks are ...
- 36.9k
4
votes
Accepted
Linux block udp on low-level against DDOS
The earliest possible point of dropping packets is the iptables raw table, as shown in the diagram in https://unix.stackexchange.com/questions/243079/netfilter-iptables-why-not-using-the-raw-table
...
- 37.6k
4
votes
My server is under DDoS. What does this log mean?
welcome to the internet.
Someone is trying to use your server as a proxy to attack someone else's machine. It doesn't look like a DOS attack on your server.
Since the attempts have been frequent ...
- 22.4k
4
votes
DDoS block source IP at ISP
The first D on DDoS means distributed.
As it's distributed, a DDoS victim will likely receive connections from hundreds of thousands of different source addresses, with different ISPs. Not only that,...
- 5,332
4
votes
DDoS block source IP at ISP
NO chance. DDOS do not have a small number of Source IP's and you would have to distinguish real and fake traffic. And there is no infrastructure on ISP level to communicate this, including providing ...
- 51.9k
4
votes
Can TCP Keepalive technique be used to prevent DDOS?
DDOS is a very broad term and includes a variety of attacks. TCP keep alive is only relevant for already established TCP connections, which usually excludes attacks using IP spoofing in the first ...
- 13.7k
4
votes
Azure Ubuntu VM: Is a connection to 168.63.129.16:80 mandatory for Basic DDOS protection?
The 168.63.129.16 is used for your VM to communicate with internal Azure resources like monitoring, guest agent heartbeat, load balancer probes and to signal to the platform the VM ready state. I've ...
- 39k
4
votes
How to drop packets based on length?
You should use the length match. It supports the range of length.
To drop all udp packets with length 1006 bytes:
iptables -I INPUT -p udp -m length --length 1006 -j DROP
P.S.
The iptables -m ...
- 5,222
4
votes
Block IPs without receiving traffic
There's nothing you can do. You don't control the upstream infrastructure, so you can't drop packets before they reach you.
- 9,203
3
votes
Is this a DDoS attack? It's been overr 48 hours. What do I do?
You need to look at your Apache logs, to understand what the incoming requests are before jumping to any conclusions. Might not be DDOS could be simply a badly coded page getting lots of traffic, or ...
- 1,352
3
votes
Is it possible to have a secondary managed DNS provider to quickly delegate to when DDOS attack on our *primary* external DNS provider happens?
There are clearly things that a DNS service provider should do, and many more that they could do, to ensure that the service is as reliable as possible.
If it appears that the service provider has ...
- 35.5k
3
votes
Does it make sense to have a server dedicated to login?
No, it is not a good idea. You can rely on the per-IP and per-username login attempt rate limits which you have already implemented to ameliorate password guessing attacks anyway.
You have ...
- 97.1k
3
votes
DDOS - Google Cloud Instance vs. Amazon AWS
This link can be interesting for you ''Best Practices for DDoS Protection and Mitigation on Google Cloud Platform'' :
https://cloud.google.com/files/GCPDDoSprotection-04122016.pdf
- 480
3
votes
Accepted
How to deal with TCP connections attack on Linux
One thing you could try to limit the impact of the connections on apache is limiting them.
There are a few ways of doing this, but one way could be:
iptables -A INPUT -p tcp --dport 80 -i eth0 -m ...
- 3,768
Only top scored, non community-wiki answers of a minimum length are eligible