LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   DDOS and pf (http://www.linuxquestions.org/questions/linux-security-4/ddos-and-pf-811771/)

sci3ntist 06-02-2010 02:54 PM

DDOS and pf
 
Hi,

I'm facing a DDOS on one of my servers with centos installed that hosts few websites, and I figured out to put OpenBSD or FreeBSD and configure pf with synproxy, like the *BSD is in the front with two network interfaces- public and private- with some nat rules to centos, could this solve the problem or reduce it at least?


Thanks in advance.

rweaver 06-03-2010 12:22 PM

Have you enabled iptables rules to eliminate as much traffic as you can? Have you given mod_evasive a try? Have you reconfigured the spawned clients, timeouts, etc to help apache deal with the syn attacks? What kind of hardware are you dealing with? How large is the ddos (how many connecting hosts)? How is your network holding up against the ddos? Is the machine having problems or the network itself?

On a large ddos everything becomes moot more or a less, but on a small to moderate sized one even a single machine can take a lot of measures to minimize the damage. A firewall in front is definitely a good idea, but there is a lot you should look at before that even.

A few quickies to try:
http://www.cyberciti.biz/tips/linux-...on-attack.html
http://www.cyberciti.biz/tips/howto-...n-attacks.html
http://forums.devshed.com/security-a...er-277224.html

unSpawn 06-03-2010 01:55 PM

We've covered DoS and DDoS options in the Linux Security forum extensively. Please search for threads on the subject. I'm sorry to say but you'll find that, regardless the type, host-based measures simply won't cut it: you'll want to involve upstream for filtering, limiting or temporarily severing the pipe.

unixfool 06-03-2010 02:48 PM

I'd love to see hard data first. A lot of the time, people assume they are DoS'd but its actually something else. For instance, I'm pretty sure that most people would think they're being DoS'd if they've a mail server that is misconfigured and in an open-relay state.

Details first, so we can help and assess if this is even a DoS/DDoS issue.


All times are GMT -5. The time now is 10:52 AM.