Re: Prevent DoS (Linux+Apache+Jboss)

[gremlin () gremlin ru]

On 31-Jan-2013 13:23:10 -0200, Daniel Armbrust wrote:

> What is the best way to prevent huge access to a web application ?

Is that a flood or just high load?

> This is a Java Application running on Jboss 5. The Operating System
> is a RedHat Linux Box with 4 GB of Ram.

Does the site have some heavy static contents (images etc.)? If yes,
you may like to move the Java stuff into the OpenVZ VPS and set up
the caching frontend (or even several frontends) using nginx.

> Always, we find in access_log a lots of requests. These high requests
> increase the "load average" of the server until its freezes.

How long does it take? Seconds? Minutes? Hours? Days?

> Normally, we pick up the "Bad IP" from access_log and make a simple
> IPTables rule, like that:
> /sbin/iptables -A INPUT -s <IP> -p tcp --syn -m connlimit
> --connlimit-above 5 -j REJECT --reject-with tcp-reset
> There is another best way ???

The simplest way to reduce the flooding effect is

iptables -t filter -A INPUT -p tcp --syn --dport 80 -m recent \
 --update --seconds 60 --hitcount 5 -j REJECT --reject-with tcp-reset
iptables -t filter -A INPUT -p tcp --syn --dport 80 -m recent --set

Obviously, the --seconds and --hitcount parameters may vary for you.
However, after kicking out the flooding bots, your server should be
able to process all the users' requests.


-- 
Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
GPG key ID: 0xEF3B1FA8, keyserver: hkp://subkeys.pgp.net
GPG key fingerprint: 8832 FE9F A791 F796 8AC9 6E4E 909D AC45 EF3B 1FA8

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------