|
嚜
Linux撘瑕之iptables嚗銝槐pt_recentmodule嚗賡餅DDoS餅 F) P' g/ H! l9 `* y4 p
靘憒嚗雿臭誑啣銝chain嚗 iptables -N WEB_SRV_DOS ":WEB_SRV_DOS - [0:0]"
; s/ k! ~0 k/ i- Y$ ~* {1 I2 L嗅嚗其誑銝隞歹60蝘吩it port 80/443頞10甈∠IP餅銝西銝靘嚗
/ @5 |5 Z" K0 J- iptables -A INPUT -p tcp -m multiport dports 80,443 -j WEB_SRV_DOS
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --rcheck --second 60 --hitcount 10 -j LOG --log-prefix "[Possible DOS Attack]"
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --rcheck --second 60 --hitcount 10 -j REJECT
- iptables -A WEB_SRV_DOS -p tcp --syn -m multiport --dports 80,443 -m recent --set
- iptables -A WEB_SRV_DOS -p tcp -m multiport --dports 80,443 -j ACCEPT
銴鋆賭誨蝣 * r; f, e$ R; {
憒雿dmesg唬憿航炊嚗
# ]" y9 p' _$ A; Q7 P2 `2 N9 Dhitcount (200) is larger than packets to be remembered (20)
0 M3 t4 x5 U5 v$ j$ W銵函內雿閮剖閬閮蝞甈⊥詨之履pt_recent閮剖銝嚗舫隤踵惺pt_recent moduleip_pkt_list_tot訾閫瘙箝
* t3 ]! ^1 ^" l: }
; i/ S! Y% ]3 O+ K8 `! o' Z& @ O皜祈岫銝銝:' H# O$ F) I$ Z4 P2 }2 w5 o
撠皜祈岫site澆箏之 http request [size=13.376px](臭誑撖怎撘靘頝嚗冽雓撌乩犖箸 灸rowser憭TAB嚗銝瑞reload蝬脤)
5 t' J8 E- A4 G T3 ]臭誑潛曉/var/log/message銝剖箇曆閮荔
- B- s5 H; N6 L0 L7 Y7 i& p4 X. sMay 17 07:12:00 localhost kernel: [Possible DOS Attack]IN=eth0 OUT= MAC=XX:XX:XX:XX:43:77:00:1f:YY:YY:YY:YY SRC=192.168.0.105 DST=192.168.0.102 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=45026 DF PROTO=TCP SPT=59437 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=03 S& S( [ {3 Z% @$ W3 Q
甇斗隞半rowser皜祈岫蝬脤嚗箇遨onnection refused嚗⊥銝(箸閮剖rule爹EJECT); A. {& y7 P* m, |- T+ y
OK嚗iptablesipt_recent module潭桐其
Q' K' j! `5 g q) \" F
% g& d! T; C2 ?+ o8 d: `7 \蝯隢嚗8 [ A) a8 O" Z+ w. y9 D
(1) iptables函雯頝臬惜喲餅餅撠嚗撠serverloading敶梢輯撠6 \" N; _* R" @6 o
(2) iptables閮剖銝頛敶改舐其脰風80,443隞亙port9 S! C! n5 p5 j& B" D# A/ V! S
(3) iptables航身摰潛函銝餅嚗箏究erver寥脰靽霅瘀臭誑摰其霈餅撠脣叫erver
' f4 p* N( D O$ y* _5 X憒雿舐決S Windows + IIS嚗亙瑕嚗雿臭誑AQTRONIX WebKnight憟鞎餌web application firewall嚗鋆⊿W單脰風DDoS餅賬
5 `7 _; }- e! v" }3 Q" @7 b, L3 z4 s% c# b' d( ?
0 a, Q, a+ F) m8 t. Y/ r. R
: http://blog.eztable.com/2011/05/17/how-to-prevent-ddos/
& F# {) {6 ~; ]6 M) }
& j" f! n; I3 X/ w* ^================================================
. R3 n2 P! j8 X5 D5 s. p! ]菜葫舐IP 隞:' O) A0 S3 Z# M7 ^! {
sed 's/ .*//' access.log | sort | uniq -c | sort -n3 ^0 i9 l$ U; K* V. p
perl -ne 'print "$1*\n" if m#^((\d+\.){3})#' access.log | sort | uniq -c | sort -n
! M3 `( u( f4 x( O1 ]% C D |
|
|