0

A Django based web forum I maintain has recently been subjected to frequent DDOS attacks at the application layer. Essentially, it seems to be an HTTP flood hitting the home page, causing the server to execute a large number of internal requests and load various files to create the page. The flood peaks at ~4000 requests per minute (typical throughput being around 500 rpm), bringing down my server in the process.

My webserver is nginx serving as reverse proxy for a gunicorn application server.

I haven't yet utilized gunicorn's security parameters: limit_request_line, limit_request_fields, limit_request_field_size). But I have nginx fail2ban installed, and have two jails in my jail.local to ensure HTTP floods are thwarted:

[nginx-postflood]

enabled = true
filter = nginx-postflood
port = http,https
logpath = /var/log/nginx/access.log
findtime = 60
maxretry = 13
bantime = 300

[nginx-getflood]

enabled = true
filter = nginx-getflood
port = http,https
logpath = /var/log/nginx/access.log
findtime = 5
maxretry = 6
bantime = 600

This setting has not helped, and I can't figure out why. When I test it, I'm able to block my IP, so it's definitely functional. Perhaps the HTTP flood has randomized IPs.

What tactics can I employ to thwart this kind of application layer DDOS? Being a newbie, I'm still wrapping my head around all this. Expert help is much appreciated!

1

I ended up handling this at nginx level. I added the following to http { in nginx.conf:

limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=7r/s;
limit_conn_status 403;
limit_req_status 403;

And then the following in the virutal host file's server { block (outside any location { blocks):

limit_conn conn_limit_per_ip 10;
limit_req zone=req_limit_per_ip burst=5 nodelay;

So far, this configuration has been working fine for me.


Note: Works for DoS, but not sure how sturdily it will hold up for DDoS. Hopefully an expert can chime in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.