|
嚜
Linux撘瑕之iptables嚗銝槐pt_recentmodule嚗賡餅DDoS餅
- K! L# _6 G4 k9 a% Q, b. X& g( u靘憒嚗雿臭誑啣銝chain嚗 iptables -N WEB_SRV_DOS ":WEB_SRV_DOS - [0:0]"3 U6 z& K# M0 S! J$ D9 V5 c. Q: X" ^
嗅嚗其誑銝隞歹60蝘吩it port 80/443頞10甈∠IP餅銝西銝靘嚗) S- h9 c8 E& S- i5 `/ M
- iptables -A INPUT -p tcp -m multiport dports 80,443 -j WEB_SRV_DOS
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --rcheck --second 60 --hitcount 10 -j LOG --log-prefix "[Possible DOS Attack]"
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --rcheck --second 60 --hitcount 10 -j REJECT
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --set
- iptables -A WEB_SRV_DOS -p tcp -m multiport --dports 80,443 -j ACCEPT
銴鋆賭誨蝣
, a2 E* f' ^) t5 K6 G憒雿dmesg唬憿航炊嚗
8 G, y. w% z% o; P, Zhitcount (200) is larger than packets to be remembered (20) 3 y) s3 U" l5 [" [: y S* E7 ?
銵函內雿閮剖閬閮蝞甈⊥詨之履pt_recent閮剖銝嚗舫隤踵惺pt_recent moduleip_pkt_list_tot訾閫瘙箝2 { T; C8 G& P9 x" `& J `
/ Y R) r# G' l/ ]# `3 C皜祈岫銝銝:
+ |& o% s }$ S% y& p撠皜祈岫site澆箏之 http request [size=13.376px](臭誑撖怎撘靘頝嚗冽雓撌乩犖箸 灸rowser憭TAB嚗銝瑞reload蝬脤)
4 ^# ]; `! v/ k6 Y1 S6 Y臭誑潛曉/var/log/message銝剖箇曆閮荔
^( y- O& p5 O' R C# Q- sMay 17 07:12:00 localhost kernel: [Possible DOS Attack]IN=eth0 OUT= MAC=XX:XX:XX:XX:43:77:00:1f:YY:YY:YY:YY SRC=192.168.0.105 DST=192.168.0.102 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=45026 DF PROTO=TCP SPT=59437 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
& `6 _& w9 _9 [+ H. V甇斗隞半rowser皜祈岫蝬脤嚗箇遨onnection refused嚗⊥銝(箸閮剖rule爹EJECT)
4 e6 `7 `) U& _( p& T: IOK嚗iptablesipt_recent module潭桐其
, |: k$ l6 K9 N, b5 m
8 Q% [5 m* |( O5 |" z- p0 w% A: s蝯隢嚗
' h4 ?# k1 G4 n v1 I% k. \(1) iptables函雯頝臬惜喲餅餅撠嚗撠serverloading敶梢輯撠9 ]. A( |, J+ V& G# c
(2) iptables閮剖銝頛敶改舐其脰風80,443隞亙port% X' S6 |* O6 l( E3 L( c
(3) iptables航身摰潛函銝餅嚗箏究erver寥脰靽霅瘀臭誑摰其霈餅撠脣叫erver
7 }; @# A( }7 u/ Z4 j) W3 V4 p憒雿舐決S Windows + IIS嚗亙瑕嚗雿臭誑AQTRONIX WebKnight憟鞎餌web application firewall嚗鋆⊿W單脰風DDoS餅賬
0 |2 }$ g* w" s7 O2 T p2 H
! s) q7 T" b ?: \9 H2 Z! x/ w% Q& e. q% E8 c# o
: http://blog.eztable.com/2011/05/17/how-to-prevent-ddos/
" V. k o* E! U) Z, q6 i6 w* T, s, t& ^+ L4 {6 I; A
================================================
9 J- z1 N+ a" I' ]7 D. G菜葫舐IP 隞:! c! _8 q2 l/ ~2 ^5 ?) G- u
sed 's/ .*//' access.log | sort | uniq -c | sort -n" {1 d, Z/ Q) W1 d. K9 N& ~
perl -ne 'print "$1*\n" if m#^((\d+\.){3})#' access.log | sort | uniq -c | sort -n
/ y. F' l' _9 j |
|
|