Re: DOS prevention
Billy Crook <[email protected]>
| Newsgroups | gmane.user-groups.linux.kansascity |
|---|---|
| Message-ID | <CANZ96zWSxB4HtwCFPpQhzOpeFbhU7rwmOEAsC-ZC4EGi5Bycqw@mail.gmail.com> |
On Mon, Mar 18, 2013 at 2:55 PM, J. Wade Michaelis <[email protected]> wrote: > The SonicWall I mentioned is in front of a lot of servers, and none of the > other services suffered any interruptions when the attacks occurred. This demonstrates that your DoS was almost certainly not caused by bandwidth exhaustion. Thus is will work fine to address it on the attacked server. > They > are hosted in a datacenter, and we have nice healthy bandwidth there. Also, > I would presume they have their own DOS prevention in place on their > routers. That is a big assumption. DoS is a fuzzy thing, and few Colos are going to risk stepping on legitimate traffic with some algorithm that can't be perfect. > The only server that had problems with these attacks was the CentOS > webserver. > > Fail2ban looks interesting. I hadn't heard of it before. What settings > would you recommend to prevent DOS attacks while allowing "normal" access > for legitimate traffic? (I can provide additional data on "normal" usage if > required.) I have my server tuned rather aggressively More than three aggressions in a five minute window, and you're banned for a year. You may want to re-tune those intervals. That said, Fail2Ban has 'filters', 'actions', and 'jails'. Filters specify logfiles to watch, what to watch FOR, and how to identify the aggressor in the log files. I have attached my filters to this message. Actions are things you want fail2ban to DO in response to finding a match. Jails specify a filter, action, and timing parameters. My Jail configuration is below: [apache-401s] enabled = true filter = apache-401s action = iptables-allports sendmail-whois[name=apache-401s, dest=root, [email protected]] logpath = /var/log/httpd/*access_log maxretry = 3 findtime = 300 [apache-403s] enabled = true filter = apache-403s action = iptables-allports sendmail-whois[name=apache-403s, dest=root, [email protected]] logpath = /var/log/httpd/*access_log maxretry = 3 findtime = 300 [apache-404s] enabled = true filter = apache-404s action = iptables-allports sendmail-whois[name=apache-404s, dest=root, [email protected]] logpath = /var/log/httpd/*access_log maxretry = 10 findtime = 60 [apache-douchebags] enabled = true filter = apache-douchebags action = iptables-allports sendmail-whois[name=apache-douchebags, dest=root, [email protected]] logpath = /var/log/httpd/*access_log maxretry = 1 findtime = 31557600 If you want to test it out, try bcrook.com. Then try a bogus url there three times in a row. For extra credit, add some non-existent paths to your robots.txt file, and tell all engines not to index them. Then add those paths to fail2ban's list of auto-ban paths. When a bad bot uses your robots.txt file to spider into directories you told it not to (or more likely when an intelligent aggressor does that), they get banned and you get emailed. _______________________________________________ KCLUG mailing list [email protected] http://kclug.org/mailman/listinfo/kclug
apache-401s.conf
(application/octet-stream, 829 B)
[Definition]
# adapted from apache-auth.conf
# Option: failregex
# Notes.: regex to match jerks trolling for exploits.
# The host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#examples:
#115.168.71.85 - - [25/Jul/2010:09:48:04 -0700] "GET /websql/scripts/setup.php HTTP/1.1" 401 479 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6"
#209.168.161.229 - - [25/Jul/2010:21:32:03 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 401 479 "-" "ZmEu"
#unknown.ord.scnet.net - - [28/Jul/2010:14:35:05 -0700] "GET /mysql/scripts/setup.php HTTP/1.0" 401 482 "-" "Wget/1.11.4 Red Hat modified"
failregex = <HOST>.*\"GET.*HTTP.*\" 401 \d{3}
# end apache-401s
apache-403s.conf
(application/octet-stream, 829 B)
[Definition]
# adapted from apache-auth.conf
# Option: failregex
# Notes.: regex to match jerks trolling for exploits.
# The host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#examples:
#115.168.71.85 - - [25/Jul/2010:09:48:04 -0700] "GET /websql/scripts/setup.php HTTP/1.1" 401 479 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6"
#209.168.161.229 - - [25/Jul/2010:21:32:03 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 401 479 "-" "ZmEu"
#unknown.ord.scnet.net - - [28/Jul/2010:14:35:05 -0700] "GET /mysql/scripts/setup.php HTTP/1.0" 401 482 "-" "Wget/1.11.4 Red Hat modified"
failregex = <HOST>.*\"GET.*HTTP.*\" 403 \d{3}
# end apache-401s
apache-404s.conf
(application/octet-stream, 829 B)
[Definition]
# adapted from apache-auth.conf
# Option: failregex
# Notes.: regex to match jerks trolling for exploits.
# The host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#examples:
#115.168.71.85 - - [25/Jul/2010:09:48:04 -0700] "GET /websql/scripts/setup.php HTTP/1.1" 401 479 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6"
#209.168.161.229 - - [25/Jul/2010:21:32:03 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 401 479 "-" "ZmEu"
#unknown.ord.scnet.net - - [28/Jul/2010:14:35:05 -0700] "GET /mysql/scripts/setup.php HTTP/1.0" 401 482 "-" "Wget/1.11.4 Red Hat modified"
failregex = <HOST>.*\"GET.*HTTP.*\" 404 \d{3}
# end apache-401s
apache-douchebags.conf
(application/octet-stream, 2.2 KB)
[Definition]
# adapted from apache-auth.conf
# Option: failregex
# Notes.: regex to match jerks trolling for exploits.
# The host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#examples:
#115.168.71.85 - - [25/Jul/2010:09:48:04 -0700] "GET /websql/scripts/setup.php HTTP/1.1" 401 479 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6"
#209.168.161.229 - - [25/Jul/2010:21:32:03 -0700] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 401 479 "-" "ZmEu"
#unknown.ord.scnet.net - - [28/Jul/2010:14:35:05 -0700] "GET /mysql/scripts/setup.php HTTP/1.0" 401 482 "-" "Wget/1.11.4 Red Hat modified"
failregex = <HOST>.*\"GET\ /*w00tw00t\.at\..*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*MyAdmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*PhpMyAdmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*admin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*pma.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*phpMyAdmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*phpMyAdmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*myadmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*mysql.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*phpadmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*webadmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*user/soapCaller\.bs.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*webdav.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*.*/admin/login\.php.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*.*/scripts/setup\.php.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*p/m/a/.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*php-my-admin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*php-myadmin.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*sqlmanager.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*sqlweb.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*Horde.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ /*horde.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ http://.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ ftp://.*\ HTTP.*\"\ .*\d{3}
<HOST>.*\"GET\ https://.*\ HTTP.*\"\ .*\d{3}
ignoreregex=