Re: (no subject)

You can use a reverse squid proxy and use "Session pools" to limit the
rate.

I can't suggest why the server is crashing or the cause.

If you are concerned with any rough edges on FC2.  Try CentOS
http://www.centos.org.  It is RHEL.  I have the ISO's.

I am deploying a new company server in the next 2 weeks - and I plan to
use CentOS and not fedora.  I get the lovely RH feel with the robustness
of RHEL for free!

I have found FC2 to be completely stable on my desktop.

Can you post some of your logs that detail this DOS attack?

We had to move data centre's before because all the othert windows
servers had osme worm and we were at 30% packet loss and 400ms latency
due to the constant attempts to connect to one of our severs SMB ports.
Which we don't have because it is Linux and also that no server in a
data centre should have - windows or linux.

In our case we could not rely on the ISP.  They blamed us - even though
I had MB's of logs and IP's of dropped offending packets.  Even my
dshield.org account fired up and they started to send me IDS alerts.

Anyway - I would start with some detailed forensics and unfortunately it
will be up to you.  Could I suggest setting up an identical server that
can server the same offending URL string and place it in a round robin
DNS and see how it performs under the same load.  A sort of "Honey Pot"
so to speak.  See if it attracts any attention?

In fact there is a special "Honey Pot" all in one bundled Linux distro
that you could try.  It can be found on distrowatch.

Cheers,
RF.



On Wed, 2004-10-20 at 10:18 +0800, Chris Drumgoole wrote:

> Hey,
> 
> I am having an issue with (what I think are) attackers bringing down
> my fedora core 2 system by spawning tons of (more than 100, some times
> up to 1000) PDF downloads from my site at once causing system
> resources to go to crap and the system dies.  Have to do a physical
> reboot - can't SSH in.  It is Fedore Core 2, HP ProLiant G3, gig ram,
> etc...  First of all, I am not sure why the machine can't handle it...
>  I am using the Fedora Core 2 default install of Apache 2.
> 
> I am thinking there must be a way to limit number of current
> connections by IP address to apache, but I am not sure how - or is
> there another way to do this?  Do you think this is even a DOS attack?
>  Has happened many times over the past 3 months, I don't think it is
> just a flashget or other download manager, seems too fishy...
> 
> Also, I don't understand why the system eventually hangs...  Not too
> happy with the HP, but it can't be a hardware issue, so I am guessing
> Fedora Core 2 is the evil doer (I believe someone from this board
> suggested that I use it.. even for a production server...)
> 
> Any ideas?
> 
> Thanks
> 
> Chris
>

_______________________________________________
blug-general list
[email protected]
http://list.beijinglug.org/cgi-bin/mailman/listinfo/blug-general