Re: [LUG] DOS protection

[Matt Stevenson <mrmstevenson@xxxxxxxxx>]

Its a cpanel server hosting a few websites and I have been looking in /usr/local/domlogs to identify which bots we want to visit and those that are there to disrupt or worse. I have not knowingly pissed off any competitors in Ukraine, Russia, Indonesia and China.

This command helped a bit to establish whose connecting to the web host. 
netstat -anp | grep :80 | grep ESTABLISHED

Googled for Linux DDos attacks. Few sites out there helped https://www.liquidcomm.net/how-to-manage-a-ddos-or-dos-attempt-directed-at-your-linux-server.html

Now looking for an open source local script or perhaps I need to connect with a Linux security company. 

Services like Cloudflare are a bit our my price range. 

Thanks to you both. 

On Monday, September 28, 2015, Gordon Henderson <gordon+lug@xxxxxxxxxx> wrote:
> On Mon, 28 Sep 2015, Matt Stevenson wrote:
>
>> Hey There
>>
>> Hope you all had a good weekend.
>>
>> Today seemed to get on my nerves the number of DOS attacks Iâm obviously
>> not setup for it.
>>
>> I found this :
>>
>> https://www.liquidcomm.net/how-to-manage-a-ddos-or-dos-attempt-directed-at-your-linux-server.html
>>
>> Who has setup there own DOS protection and what do you use ?
>
> What are you doing that (a) exposes your IP address and (b) pisses someone off enough to DDOS your home connection? (assuming it's your home connection being targeted)
>
> The only time I've ever had anything close to that was sipvicious attacks.
>
> However if its a hosted server then (b) applies.
>
> You can firewall your server/home connection to drop packets, however without the cooperation of the ISP those packets have already come down the wire to your firewall, so if you get billed for them, then expect big bills as the firewalling is doing nothing.
>
> Gordon
-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq