Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Distribution: Debian,Slackware,FreeBSD,CentOS,Red Hat,Windows Server 2008
DDOS and pf
I'm facing a DDOS on one of my servers with centos installed that hosts few websites, and I figured out to put OpenBSD or FreeBSD and configure pf with synproxy, like the *BSD is in the front with two network interfaces- public and private- with some nat rules to centos, could this solve the problem or reduce it at least?
Have you enabled iptables rules to eliminate as much traffic as you can? Have you given mod_evasive a try? Have you reconfigured the spawned clients, timeouts, etc to help apache deal with the syn attacks? What kind of hardware are you dealing with? How large is the ddos (how many connecting hosts)? How is your network holding up against the ddos? Is the machine having problems or the network itself?
On a large ddos everything becomes moot more or a less, but on a small to moderate sized one even a single machine can take a lot of measures to minimize the damage. A firewall in front is definitely a good idea, but there is a lot you should look at before that even.
We've covered DoS and DDoS options in the Linux Security forum extensively. Please search for threads on the subject. I'm sorry to say but you'll find that, regardless the type, host-based measures simply won't cut it: you'll want to involve upstream for filtering, limiting or temporarily severing the pipe.
I'd love to see hard data first. A lot of the time, people assume they are DoS'd but its actually something else. For instance, I'm pretty sure that most people would think they're being DoS'd if they've a mail server that is misconfigured and in an open-relay state.
Details first, so we can help and assess if this is even a DoS/DDoS issue.