Tag Info

Hot answers tagged

21

OK, so it turns out, the Role has to be added. I went to Server Manager > Roles > Add Role Services. Under Security node in the Role Services tree there is an option for IP and Domain Restrictions. Checking that installed the role services and now my IIS Manager has an icon for "IPv4 Address and Domain Restrictions". Feels like this should be installed ...


19

I experienced such attack ... in the middle of midsummer (23th of June), where you are supposed to be in the countryside and drink beer :> I put my Apache behind Varnish, which not only protected from slowloris, but also accelerated web requests quite a bit. Also, iptables helped me: iptables -I INPUT -p tcp --dport 80 \ -m connlimit ...


18

Instead of blocking it, you can employ a different approach - I think I heard it on one of the SO podcasts, and/or maybe SO use it as well. Do not delete the account and the posts - just make them visible only to this account and noone else. The kid will continue to try while you play his game. If he sees that his comments are not deleted, he may loose ...


16

It means the router has to maintain additional state and do additional work on each packet. And how can it really help in the case of a DoS? All it can do is drop a packet that you have already received. Since you've already received it, it has already done the damage by consuming your inbound Internet bandwidth.


9

there is no way that us or any other company could feasibly put hardware firewalls in all of our datacenters Yes, yes there is. Please re-evaluate your economics (How much does a firewall cost? How much do you lose per hour when you're down because of a DDoS? How much damage will be done to your reputation when someone finds an accidentally-open RDP ...


8

Apache has a theory of 'Maximum Clients' That is the number of simultaneous connections it can handle. I.E. if an apache server has a 'max clients' limit of 100, and each request takes 1 second to complete, it can handle a maximum of 100 requests per second. An application like SlowLoris will flood a server with connections, in our example if SlowLoris ...


8

Contact your ISP and give them this information. They'll need to drop the traffic on the backbone. Once the traffic hits your firewall, the resources are already being consumed on your end. The only way to stop this is to drop it on the backbone.


7

You should configure your perimeter firewall to not allow non-internal IP's to access your domain controllers (frankly they shouldn't access any systems on your internal IP's, they should go to a DMZ). If you're not getting IP's in the event logs you may want to capture packets and determine the source of these attacks.


7

No port is any more or less vulnerable than any other, if it has the same service listening on it. If both ports are running web services, there's not much difference between their vulnerability to DDoS. If your "competitors" are experienced in initiating DDoS attacks, I predict that regardless of what you do, with your current level of knowledge, you will ...


6

There are some fairly good answers in this question


6

This may not be a DoS against you - it's much more likely that your machines are being used to send packets to someone else. This is called an "amplification attack". They send you a 25 byte DNS request - you send back ~500 bytes of root hints. If this is the case, the source IP addresses are actually spoofed, and they're taking advantage of your large ...


6

If you can afford sixty servers, with sixty licenses of Server 2008, and the payroll costs for sysadmins to support and developers to code enough games that need sixty servers to run, then you can afford dedicated firewalls. Also, take it as truth that (almost) all other companies "feasibly put hardware firewalls in all of [their] datacenters." As far as ...


6

I'd say that the IP address your hosting provider gave you was previously used as a C&C or distribution node for a botnet, and some malware hasn't got the message that you're no longer carrying that stuff. Unfortunately, there's not a lot you can do about it, other than bugging your provider and saying you want new IPs because this one's tainted. You ...


6

Denial of service attacks focus on consumption of a finite resource. Mostly that refers to network traffic, but it could be anything that you can run out of. For example, if your web servers take five seconds to generate a certain complex page, I can save myself a lot of traffic generation and just make a lot of requests for that slow page which rapidly ...


5

You've setup basically the worst case scenario and are apparently determined to stick with it. Putting the server publicly accessible from the Internet is just asking for trouble as you have found out. The correct solution is to setup a VPN and use that. I'm curious why you don't want to. It adds a single step to the process of connecting to the server ...


5

None of those will really protect from DDoS attacks. The point of a DDoS is to use up so much of the targets bandwidth that no legitimate traffic can get through. Having a captcha or something will protect from bots, but thats about it. The only way to mitigate (but not solve) the risk of DDoS attacks is to get more bandwidth and failover agreements with ...


5

From your own description I would suggest you start by removing that counter and see if that really does make a difference. It's so easily tested that I'm surprised you haven't already done so.


5

Don't block the robot completely, but slow it down with QoS rules (in linux, check out the "tc" command). Also, read this. This is how the people running this very website solved the problems using Haproxy.


5

You can't prevent DOS attacks, you can only mitigate them. Keep a small attack surface. Turn off services you aren't using, block access to ports that only need to be accessed from specific locations, make sure your daemons have sensible defaults about how many threads they run and how to behave when system resources run low. Monitor traffic. Know when an ...


5

How many cores your server has ? If you have two cores, i suggest you can set 2 workers and 250 conn. max. max_clients = worker_processes * worker_connections And Yes, the 501 connection will receive an error. But be carefull, a browser opens 2 connections by default. EDIT: One more thing, you can set a max connection limit by IP (10 here) with ## Max ...


4

Ideally you shouldn't have to manually look at logs for these signs, they should be set as alert thresholds that generate automated SNMP/Mail traps, and in some circumstances initiate preemptive measures. As for specific rules, connections/sec or similar will vary based on hardware but consistent high CPU utilisation (80%+) is usually cause for concern, ...


4

Preventing a DDoS is mostly about not being a target. Don't host game servers, gambling/porn sites, and other things that tend to get people annoyed. Mitigating a DDoS attack comes in two forms: being able to ignore traffic and shed excess load, which is useful when you're under an attack that tries to take you down by overloading your machines (and also ...


4

[reverse DNS result]: you've been identified as a robot operating in violation of the guidelines posted at arxiv.org. If this determination is in error, please report to www-admin@arxiv.org so your problem can be investigated. Scanning, Initialized: 10 minutes to Trinity... 9 minutes to Trinity... 8 minutes to Trinity... 7 minutes to Trinity... 6 ...


4

If it's available you could try having to approve new accounts or approving the first post of a newly created account.


4

Wget does no more and no less than an actual web browser with the only exception that it can be told to suck a whole site down which it can do without delay and which on a real web-browser is just about impossible to do quickly. I often use it, for example, to grab data in a particular directory hosted at a site as for some jobs it's much more efficient than ...


4

As Niall mentioned, mod_evasive works really well in this situation and I recently used it to stop a very similar problem I was having on one of my sites. It helps in the situation where you aren't receiving a ton of connections on a single IP but you do see unnatural patterns occurring on the server. In my case, which I also blogged about here, I installed ...


4

You can add an IP/network to the fail2ban whitelist to accomplish just that (the second part, I mean). Edit the ignoreip parameter on your jail.conf (probably on /etc/fail2ban). As for the first part, I saw this workaround mentioned on the fail2ban wiki: http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban


4

I'd be much more concerned about the fact that you're running 2.2.17, which is vulnerable to the Range Header DOS attack on unpatched Windows. 6.1.7600 is either Windows 7 or Windows Server 2008 R2 without SP1 installed. All of the Apache modules in the world won't save you from a kernel vulnerability or Apache vulnerability like the range header exploit. ...


4

You can give your preferred user account or user group a nice value in /etc/security/limits.conf, at least if we are talking about Linux. Then when you login via sshd, you will have nice value of X, whatever you set it. In my experience the CPU scheduler in kernel is nowadays so good it's hard to make server unmanageably sluggish just by burning CPU cycles, ...



Only top voted, non community-wiki answers of a minimum length are eligible