3

I'm running some web applications on an debian server and have to struggle with ddos attacks sometimes. It's eating up all my resources and I can't ssh anymore into the server. An idea was to drop all connections if the load avg is too high, so there are still resources for me and accept new connections if the load avg is low enough. Since this has to work under heavy load I'm afraid a cronjob wouldn't be fast enough or take too much resources.

tl;dr: Is there a way to configure the behavior if the load avg is above a specific threshold?

3
  • Which DDoS type are you facing?
    – quanta
    Aug 30, 2012 at 14:53
  • @quanta At the moment I'm fine, but my server went down a few times after a huge load of http requests. I know there are more ways to address this problem but I want to build a second solution if the first one fails.
    – sfx
    Aug 30, 2012 at 15:07
  • Could you please show us a snippet of web server log when being DDoS?
    – quanta
    Aug 30, 2012 at 15:12

1 Answer 1

4

While I think you should try to address the real problem at the firewall or network level, a quick-and-dirty approach to resource-based actions is to use the Monit utility.

Specifically, Monit can perform resource tests, alert you and take action based on those conditions.

IF resource operator value [[<X>] <Y> CYCLES] THEN action [ELSE IF SUCCEEDED [[<X>] <Y> CYCLES] THEN action]

So...

check system example.com
    if loadavg (1min) > 10 then alert

Or for something specific to Apache:

check process apache with pidfile /var/run/httpd.pid
start program = “/sbin/service httpd start”
stop program = “/sbin/service httpd stop”
if children > 250 then restart
if loadavg(5min) greater than 10 for 8 cycles then stop
if 3 restarts within 5 cycles then timeout

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .