Security Basics mailing list archives
Re: Prevent DoS (Linux+Apache+Jboss)
From: gremlin () gremlin ru
Date: Sat, 2 Feb 2013 13:40:03 +0400
On 31-Jan-2013 13:23:10 -0200, Daniel Armbrust wrote:
What is the best way to prevent huge access to a web application ?
Is that a flood or just high load?
This is a Java Application running on Jboss 5. The Operating System is a RedHat Linux Box with 4 GB of Ram.
Does the site have some heavy static contents (images etc.)? If yes, you may like to move the Java stuff into the OpenVZ VPS and set up the caching frontend (or even several frontends) using nginx.
Always, we find in access_log a lots of requests. These high requests increase the "load average" of the server until its freezes.
How long does it take? Seconds? Minutes? Hours? Days?
Normally, we pick up the "Bad IP" from access_log and make a simple IPTables rule, like that: /sbin/iptables -A INPUT -s <IP> -p tcp --syn -m connlimit --connlimit-above 5 -j REJECT --reject-with tcp-reset There is another best way ???
The simplest way to reduce the flooding effect is iptables -t filter -A INPUT -p tcp --syn --dport 80 -m recent \ --update --seconds 60 --hitcount 5 -j REJECT --reject-with tcp-reset iptables -t filter -A INPUT -p tcp --syn --dport 80 -m recent --set Obviously, the --seconds and --hitcount parameters may vary for you. However, after kicking out the flooding bots, your server should be able to process all the users' requests. -- Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru> GPG key ID: 0xEF3B1FA8, keyserver: hkp://subkeys.pgp.net GPG key fingerprint: 8832 FE9F A791 F796 8AC9 6E4E 909D AC45 EF3B 1FA8 ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- Re: Prevent DoS (Linux+Apache+Jboss) gremlin (Feb 04)
- Re: Prevent DoS (Linux+Apache+Jboss) Rællic Systems (Feb 04)