On 07/18/2012 10:15 PM, Patrick Kevin McCaffrey wrote:
>
> netstat -ntu | grep ':' | awk '{print $5}' | sed 's/::ffff://' | cut
> -f1 -d ':' | sort | uniq -c | sort -nr > $BAD_IP_LIST
>
> So, I ended up running a DOS attack a few times from my development
> box (192.168.30.255) to the server, and testing how many connections
> this script was seeing by manually running netstat on the server via
> SSH from the dev box. To my dismay, the only connections that it saw
> from my dev box to the server were the 3 SSH connections I had open
> in various terminals.
>
> Apparently, my Shorewall rules are forwarding the requests
> immediately to the web server container before DDOS-deflate has a
> chance to analyze the traffic?
>
Connections to the server are not going to be visible on the host using
'netatat'; so DDOS-deflate isn't the right tool to deploy on your host
unless you rewrite the above command to use 'conntrack' or to read
/proc/netfilter/nf_conntrack (the latter is deprecated).
What I suggest is that you implement per-IP rate limiting in your
Shorewall configuration. It can be specified in both the policy file and
on individual rules in the rules file.
You specify s:<connections>/<time>:<burst>.
Example: s:10/min:10
See http://www.shorewall.net/configuration_file_basics.html#RateLimit
for an explaination.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
