|
嚜
Linux撘瑕之iptables嚗銝槐pt_recentmodule嚗賡餅DDoS餅% w. c, d' j' T2 X; F# I8 N. V
靘憒嚗雿臭誑啣銝chain嚗 iptables -N WEB_SRV_DOS ":WEB_SRV_DOS - [0:0]"
3 b4 f" f+ F- H* I9 n, N$ s嗅嚗其誑銝隞歹60蝘吩it port 80/443頞10甈∠IP餅銝西銝靘嚗& {1 b; i0 S- u. S: E) u
- iptables -A INPUT -p tcp -m multiport dports 80,443 -j WEB_SRV_DOS
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --rcheck --second 60 --hitcount 10 -j LOG --log-prefix "[Possible DOS Attack]"
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --rcheck --second 60 --hitcount 10 -j REJECT
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --set
- iptables -A WEB_SRV_DOS -p tcp -m multiport --dports 80,443 -j ACCEPT
銴鋆賭誨蝣 : @* ~ O4 I# i/ q" N H2 g
憒雿dmesg唬憿航炊嚗 ! |. R" Y, I2 }- o
hitcount (200) is larger than packets to be remembered (20) * X% S- D3 M i Q
銵函內雿閮剖閬閮蝞甈⊥詨之履pt_recent閮剖銝嚗舫隤踵惺pt_recent moduleip_pkt_list_tot訾閫瘙箝
7 P! x, X6 W+ X; O
7 n+ W7 Z# n- U皜祈岫銝銝:
; k: r% D! w2 }- z2 t/ U撠皜祈岫site澆箏之 http request [size=13.376px](臭誑撖怎撘靘頝嚗冽雓撌乩犖箸 灸rowser憭TAB嚗銝瑞reload蝬脤)7 Y; _9 B9 S! c3 Z# I8 u, B
臭誑潛曉/var/log/message銝剖箇曆閮荔
# u4 k6 X: y# l: j9 \+ YMay 17 07:12:00 localhost kernel: [Possible DOS Attack]IN=eth0 OUT= MAC=XX:XX:XX:XX:43:77:00:1f:YY:YY:YY:YY SRC=192.168.0.105 DST=192.168.0.102 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=45026 DF PROTO=TCP SPT=59437 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0! D& N# l. V a; f
甇斗隞半rowser皜祈岫蝬脤嚗箇遨onnection refused嚗⊥銝(箸閮剖rule爹EJECT)
7 x+ G; ?6 q% R# kOK嚗iptablesipt_recent module潭桐其
' f' N3 Y5 L ?3 Z8 ~# Y5 D* X8 R5 o: j0 x9 ]# i0 D' x2 n
蝯隢嚗5 F$ V+ e/ N! e$ l% ^; v; _
(1) iptables函雯頝臬惜喲餅餅撠嚗撠serverloading敶梢輯撠
8 M0 D% }: {1 R# F(2) iptables閮剖銝頛敶改舐其脰風80,443隞亙port& b3 {# ~! S/ I- X3 }1 a
(3) iptables航身摰潛函銝餅嚗箏究erver寥脰靽霅瘀臭誑摰其霈餅撠脣叫erver
- j- B" p( H4 V% h, @( D: U* S7 l; |$ _憒雿舐決S Windows + IIS嚗亙瑕嚗雿臭誑AQTRONIX WebKnight憟鞎餌web application firewall嚗鋆⊿W單脰風DDoS餅賬
3 J. B3 R/ |" l2 l, t
# S! _* G" a' C" {4 U7 Y% z# E/ J! P0 Y; B3 a& c, F/ i, I2 x4 x9 E
: http://blog.eztable.com/2011/05/17/how-to-prevent-ddos/( e, o% M' I# ^6 @) G2 n3 c4 g/ \
; s, X0 ^1 w0 I8 d
================================================
, T; a! p i3 b8 Y# m. }! k& h菜葫舐IP 隞:
7 Q% j( h9 _/ e1 \5 F. x1 lsed 's/ .*//' access.log | sort | uniq -c | sort -n
. V; {8 i5 H; |1 zperl -ne 'print "$1*\n" if m#^((\d+\.){3})#' access.log | sort | uniq -c | sort -n
: `) n! M; f7 a- z% i1 C( r5 m0 F7 z |
|
|