I haven't had much time to contribute to teases and the like, so let me contribute here with my knowledge on the subject. For the last two years I've run a site of my own that has been the subject of constant attacks, both denial of service attacks and attacks intended to compromise the server. So, here are a few tips you might want to think about. I know several people come here who also run their own sites, and this might apply to them, so I'm making most of what I have to say on this public. If you'd like to talk further Seraphox, feel free to PM me.
IPtables tricks
There are a few things you can do with iptables that help with this sort of thing a great deal. Namely, you can limit connections based on network blocks.
Code: Select all
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 4 -m limit --limit 4/minute -j LOG --log-prefix "HTTP-DOS: "
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 4 -j DROP
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -m limit --limit 4/minute -j LOG --log-prefix "HTTP-DOS: "
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j DROP
iptables -A INPUT -p tcp --sport 1024:65535 -m multiport --destination-ports 80,443 -m state --state NEW -j ACCEPT
The above rules ensure that any given IP address cannot have more than 4 open connections to port 80 at any given time, and that a any given class C subnet will only be allowed to have 16 open connections at a time. The last rule allows in new traffic not blocked by those rules, and tells the connection tracking feature in the kernel to handle them (performance increase). The log rules there will only trigger a max of 4 times per minute, which lets you log that an attack has happened, but without filling up all of your logs. You can then later parse the logs for abusive IP's and block them specifically.
The above tactic would also work for just about any port, but you'll have to play with the limits if it's something intensive like mail or dns.
It can help sometimes to use a stateful firewall, which you can do about like this:
Code: Select all
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#===========================
iptables -A INPUT -i lo -s 127.0.0.0/8 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT
#===========================
iptables -A OUTPUT -o lo -d 127.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
And then the rest of your rules go after that, but you change any of your rules which would just be -j ACCEPT to -m state --state NEW -j ACCEPT. The effect this has is that a new connection only traverses your full set of rules one time. If the first packet meets all the rules to be allowed through then the firewall keeps track of that so it doesn't have to fully inspect the rest of the packets. This leads to much higher performance and mitigates a minor DoS condition from someone just trying to make a bunch of connections at once.
Kernel Tricks
These commands turn on some security features in the kernel which are disabled by default. There isn't any noticeable performance hit from turning them on (in my experience), and they each protect against some common network-based attacks.
Code: Select all
#enable broadcast echo protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#disable source routed packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done
#enable syn cookie protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#disable icmp redirects
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done
#disable icmp redirect messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo 0 > $f
done
#drop packets which would have a reply sent on a different interface
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
#log packets with impossible addresses
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 1 > $f
done
There are a few apache modules you might want to check out, like
mod_evasive, which analyzes HTTP requests in real time and will automatically block and/or throttle offensive clients for configurable periods of time. I've rarely run into any trouble with it blocking legitimate visitors, and it helps a lot against brute force attacks and general DoS attacks against Apache. Just be aware that it does sometimes mistake download managers as attacks. Installing the
suhosin patch for PHP probably isn't a bad idea either.
If you can, I highly recommend running Apache inside of a chroot and enforcing per-process resource limits (which you can do with grsecurity/pax and some other methods).
Anyway, I hope this helps out.
-ps: OpenBSD's pf firewall stands up to this kind of crap WAY better than Linux.
