My server is under dos attack (http) , I have installed APF firewall and ddos deflate. I configure them to work together.
now if any IP with more than 100 connections is black listed by dos deflate, I can see it in apf's deny_hosts.rules file.
everything seems correct, but my server still very slow.
the ip which is causing that has more than 1000 request and is blacklisted.
Quote:
Mar 10 20:17:55 host kernel: printk: 102 messages suppressed.
Mar 10 20:17:56 host kernel: printk: 3 messages suppressed.
Mar 10 20:18:01 host kernel: printk: 98 messages suppressed.
Mar 10 20:18:35 host kernel: printk: 34 messages suppressed.
Mar 10 20:18:51 host kernel: printk: 189 messages suppressed.
Mar 10 20:18:56 host kernel: printk: 195 messages suppressed.
Mar 10 20:19:02 host kernel: printk: 249 messages suppressed.
Mar 10 20:19:06 host kernel: printk: 36 messages suppressed.
Mar 10 20:19:21 host kernel: printk: 3 messages suppressed.
Mar 10 20:19:26 host kernel: printk: 342 messages suppressed.
Mar 10 20:19:31 host kernel: printk: 509 messages suppressed.
Mar 10 20:19:47 host kernel: printk: 54 messages suppressed.
Mar 10 20:19:51 host kernel: printk: 421 messages suppressed.
Mar 10 20:19:56 host kernel: printk: 542 messages suppressed.
Mar 10 20:20:01 host kernel: printk: 785 messages suppressed.
Mar 10 20:20:16 host kernel: printk: 340 messages suppressed.
Mar 10 20:20:21 host kernel: printk: 337 messages suppressed.
Mar 10 20:20:26 host kernel: printk: 430 messages suppressed.
Or is this something else? It's been going on for about 40 minutes. I seen my load jump to 20, to 100 and back and fourth
I'm sure that i have Trojans and Viruses on my Server but every time i contacted My Company they ask me to pay money and then they will check and scan my server
so is it any Free application which can scan and remove all bad files on my Server? i'm looking for free applications to scan the whole server
My server stop responding, I couldn't access via webmin or ssh, and DNS were not responding, so I have to ask for a reboot and now everything is fine.
Looking at the logs I found this:
Code:
Jul 18 19:23:12 server sshd[18484]: Failed password for root from 61.145.196.117 port 56817 ssh2
Jul 18 19:23:12 server sshd[18485]: Failed password for root from 61.145.196.117 port 60227 ssh2
Jul 18 19:23:13 server sshd[18488]: Failed password for root from 61.145.196.117 port 38038 ssh2
Jul 18 19:23:15 server sshd[18493]: Failed password for root from 61.145.196.117 port 49884 ssh2
Jul 18 19:24:30 server sshd[18497]: Failed password for root from 61.145.196.117 port 37929 ssh2
Jul 18 19:25:06 server sshd[18521]: Did not receive identification string from 61.145.196.117
Jul 18 19:25:09 server sshd[18508]: Did not receive identification string from 61.145.196.117
Jul 18 19:25:14 server sshd[18505]: fatal: Timeout before authentication for UNKNOWN
Jul 18 19:26:00 server sshd[18509]: Did not receive identification string from 61.145.196.117
And searching that IP on google I found it here: http://www.tcc.edu.tw/netbase/net/in...?fun=240&prd=3
And is flagged as a SSH Attack.
Any ideas why my server stopped working? and how to prevent it?
Im using CentOS 5.0
i found my site load slowly, the cpu load is good. I run this command
[root@host ~]# netstat -nap |grep SYN |wc -l
526
It's seem my server is having problem with SYN attack. Is there anyway to protect it ?
I'm running apache 2.
My site currently in prolong HTTP flood attack since 2 weeks ago. The attack was never stop and for this moment i could only mitigate the attack using my own firewall (hardware).
Since my ISP is not interested to help from upstream, even provide any mitigation services, i could only doing mitigation on my own source or using proxy services alternatively as well, but i've chose to tried on my own. I've tried once on one of well-known mitigation services out there but it seems not fully satisfied me since most of legitimate traffic is blocked from their source.
What i could do now is keep staying alive as well as will not going down on whatever situation becomes worst (but if the attack change to udp attack, i couldn't help myself coz there must be high incoming bandwidth into my network). My network is totaling 10MB last time but since this attack i've been forced to subscribe for 30MB in order to keep balance on the attack.
I've blocked all access except for my country and some other neighbours. If i change policy to allow all countries, the load of firewall will become max and after that hang will hang in less than a minute. I've done load balancing of 4 servers (8GB memory each one) and it seems the condition is getting under control with slight problem of server hang (memory shortage) and very limited keep alive connection.
Now what am i thinking is to buy a router objectively to null route incoming specific IP of countries so i can change my firewall policy to allow all connections as well as to help the firewall itself release its burden halting blocked IP that currently keep hitting itself that could might impact its performance.
Which brands of router is possible doing this thing?
Do you have some other suggestions instead of buying router?
i am just having one issue in one of my highly visited website hangibar.com, its being hosted in softlayer, we are facing synattack too much in this website.
the solution which microsoft given in their website related with tcp/ip registry entry but thing is same , some where and some connections become increases too much over tcp/ip. due to that reason website become very sticky and it stop functioning the execution of sql process, during this issue i have to restart the server to establish a fresh connection.
im getting a syn attack and my vps getting overloaded what im doing is banning ip's that gets most connections
after banning server get normal but if there anyway to stop this post method
There are lot of perl process with 100% usage on server. When i tried to view error_log it shows following:
[root@local ~]# tail -f /var/log/httpd/error_log
=> `Lnx.txt'
Resolving gihkus.com... 208.98.48.116
Connecting to gihkus.com|208.98.48.116|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 16,577 (16K) [text/plain]
0K .......... ...... 100% 316.78 KB/s
05:26:03 (316.78 KB/s) - `Lnx.txt' saved [16577/16577]
When i tried to view this http://gihkus.com/Lnx.txt it seems to be attack on my server. http://gihkus.com/Lnx.txt is not hosted by us. I have disabled perl support on all domains hosted on our server but still we are under attack. There is nothing special in /tmp.
Over the past day one of my servers has seen a huge rise in incomming traffic (from normal web requests to a constant 4Mbit/s, peaking upto 80Mbit/s). My outgoing traffic has remained at its normal profile, so I am pretty sure that these are not web requests, and it does not seem to be having an adverse effect on the server (the site still runs perfectly well and quick and load is still less than 1).
However, I am unsure as to how to identify what this traffic is? Are there any easy ways to tell on a FreeBSD server what the source and type of incomming traffic is? I have tried playing with netstat, but an not getting anything useful - I would like to see which ports are involved.
Am Really suffering here for ddos attack ( apache - pop3 ) every week my server under attack am using APF but now am really wanna get red from it am looking for a powerfull firewall I do not know if CSF Could stop this attack like limiting receiving SYN from an ip or any other policy another thing . i have get this rules from forums but am really weak at iptables rules so can any one help my if these rules useful or not . against Dos attack:
iptables -t nat -N syn-flood
iptables -t nat -A syn-flood -m limit --limit 12/s --limit-burst 24 -j RETURN
iptables -t nat -A syn-flood -j DROP
iptables -t nat -A PREROUTING -i eth0 -d (dest ip) -p tcp --syn -j syn-flood
My server is using too many httpd process..I think iam under DDOs attack..I executed the following command..
netstat -an | grep :80 | sort
and the result is this
tcp 0 1491 ::ffff:95.211.10.169:80 ::ffff:213.215.100.110:2263 LAST_ACK
tcp 0 1493 ::ffff:95.211.10.169:80 ::ffff:85.207.126.231:52694 LAST_ACK
tcp ....
I have a windows server, and today it has a large inbound traffic, so I tried to disable all web service, and after that, the result of netstat -an shows no connection at all, but the server still has large inbound traffic,
Do you have any idea about this?
What should I do now?
Our server is in attack since 4 days. Http port busy all the time.
When I type :
netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut -d: -f1 | sort -n| uniq -c | sort -n | tail -5
It shows :
[root@ ~]# netstat -na | grep ":80" | awk '{print $5}' | cut -d. -f1-4 | cut
-d: -f1 | sort -n| uniq -c | sort -n | tail -5
2 65.19.130.24
2 83.149.120.9
4 204.15.73.243
35 222.254.103.142
5128
[root@ ~]#
I wonder the hidden IP of 5128 ??? How to know it?
The server getting slow with high I/O diskwait then normal, although load is not high.
here is the output of: netstat -anp |grep 'tcp|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n .................
i had installed anti ddos or firewall,but those are useless.His attacks are such great that The server and all the vps are down now. One told me that I should check the ips and receive ips. The attacker is so skillful .describe the best method to defeat him. Be sides the attacker use diffirenet ips in each attack,I block him by iptables but no use…. His attack occupy all the ram and I have to resetart the server… Now this time his attack lead to shutting all the vps down
View 10 Replies View RelatedMy website is under ddos attack from some competitors. I don't know yet how big is the attack. The ips of the ddos attack come from all the world.
I have contacted a few hosting companies specialised in ddos proof hosting, unfortunatly the price is so expensive that i cannot afford it.
So i try to find another solution : my website is only aimed to the french people, so maybe is it possible to install a kind of firewall or proxy located before the server to block all the incoming IP adress not from france ? Do you know some websites who can do this and the price ?
I already try do deny the non-french ip in one htaccess file but the ddos attack saturate the server anyway.
We are currently experiencing an SYN Flood attack on our primary production server and are looking for some help in resolving the issue.
Running:
Novell SUSE Linux Enterprise Server 10.2-64
SuperMicro X7DBR-E Intel Xeon QuadCore DualProc SATA [2Proc]
Processor Intel Xeon-Clovertown 5320L-QuadCore [1.86GHz]
8GB Memory
@ Softlayer DC in Texas.
Need help within the next hour or two. Please ask any necessary follow up questions and how you might go about resolving the issue (i.e. SYN Cookies, etc.)
someone decided to attack my webserver and I can't figure out how to block it.
tcp 0 0 localhost:80 207.44.129.88:2138 SYN_RECV
tcp 0 0 localhost:80 207.44.129.88:2243 SYN_RECV
tcp 0 0 localhost:80 213.66.121.211:63372 SYN_RECV
It's literally thousands of those requests overloading apache. The server is fine, the load average is like .8. But none of the website are loading.
We're hosting with ThePlanet, and they're doing a great job at blocking a huge portion of the attack. But we're still getting hit pretty hard. I've got APF installed, and 3 or 4 anti-dos scripts.
Every once in a while a page will load for the websites, I think we've got just under 50 legit connections.
My server is currently underattack, I have been able to keep it up but after I ban 500 IPs, I get a lot of different IPs again.
Any idea or suggestion to do mass-ban to those attacking IPs?
tcp 0 0 xxx.xx.xxx.xxx:80 190.87.128.59:3965 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 82.115.52.10:2323 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 90.148.137.56:21094 SYN_RECV
tcp 0 0 xxx.xx.xxx.xxx:80 189.237.35.155:57605 ...
i,m under attack i got in csf today this
77.195.42.235 # lfd: (PERMBLOCK) 77.195.42.235 has had more than 4 temp blocks in the last 86400 secs - Wed Apr 1 09:39:35 2009
151.60.86.210 # lfd: (PERMBLOCK) 151.60.86.210 has had more than 4 temp blocks in the last 86400 secs - Wed Apr 1 09:39:51 2009
and these two ips was attack me them down site for 2 minutes but then block in csf
so i just wanna ask now this option in CSF
LF_PERMBLOCK : 1
i make it open 1 so this the reason can block the ips attack. or this the reason make them can attack ?
so i should keep this option 1 or make it 0 to stop this kind of ddos attacking?
Our forum is under attack...and our host won't do anything except tell us that our load is too high and that they might turn off our account.
But, we've already turned off the forum...the only load is a note that says it's down for maintenance...no database...no html...nothing.
In a very short amount of time it has has over 300,000 page requests for the same three pages.
Is there anything on my side (since I don't run the server) that I can do to stop this or prevent it...etc?
my exim is under ddos:
exim (pid 8042 8158 8169 8175 8249 8254 8267 8276 8384 8397 8398 8556 8560 8561 8587 8663 8669 8705 8707 8711 8752 8783 8790 8796 8799 8811 8881 8883 8884 8929 8932 8934 9014 9019 9025 9035 9060 9087 9089 ...............)
how can i solve it?
I got this email:
"Dear Team
It appears that your website name_of_my_site has been hacked by a fraudster. It is now hosting a phishing attack against Peoples Trust Credit Union.
Please remove the fraudulent folders/files as soon as possible and secure your website as it has been compromised.
peoplestrustcu.org.name_of_my_site/update_account/
In addition, please send us any source files of the attack.
Please let us know if you have any questions or need further assistance. We appreciate your cooperation.
RSA Anti-Fraud Command Center
RSA, The Security Division of EMC
"
I look at subdomains...and I dont have any, I look at .htaccess nothing, look at 404 page, nothing..also look at template files and no any iframe or similar?
I would like to know what are the best ways in preventing a UDP D/DoS Attack. DDoS-Deflate and most programs like that are just for TCP connections, and most of the time only for port 80. What is the best option out there for protection (linux wise) for UDP attacks. I was using shorewall before but it did not do so well so I just switched now to CSF [url] with WebMin and seems to be working ok. Even though thoes are both firewalls, they seem to have some protection against UDP Attacks. Please note this is a server that just hosts some game servers, no webhosting. What would be my best option here?
View 3 Replies View RelatedI have a problem since two days. I am facing a DoS attack on one of my IP's with 20Mbit of UDP Packets.
These are the packets I receive:
Code:
16:19:26.949003 IP (tos 0x0, ttl 49, id 14236, offset 0, flags [DF], proto: UDP (17), length: 29) 222.90.73.53.33713 > foo.com.www: [udp sum ok] UDP, length 1
My provider says they can't do anything. The only thing they could do is shut down my IP. Which is not really helpful. I have no idea what to do or what else I could analyze.
It would be very interesting if the IP is being attacked or one of the sites I host.
I have already over 300GB traffic since yesterday because of this.
my server load is currently
load average: 13.23, 11.34, 10.53
when i look at the apache server-status, it says i am using .723% of cpu.. so i don't think that is the problem.. i ran this command..
/var/qmail/bin/qmail-qstat
and it came out with..
messages in queue: 3061
messages in queue but not yet preprocessed: 29
is that a lot of messages in queue?
when i do top.. these are some of the processes that come up first..
10749 popuser 18 0 12.9 0:00.39 0.1 2924 380 304 D qmail-local
368 popuser 16 0 2.7 0:15.32 3.9 30720 19m 2244 S spamd
10712 mailman 18 0 1.7 0:00.07 0.6 5764 3124 1800 D gate_news
10678 root 17 0 0.7 0:00.09 0.2 3820 1064 780 R top
178 root 15 0 0.3 81:43.17 0.0 0 0 0 D kjournald
1827 root 15 0 0.3 76:52.47 0.1 2412 456 380 D syslogd
9170 qmails 15 0 0.3 50:27.14 0.1 2448 540 372 D qmail-send
9174 qmailr 16 0 0.3 7:55.07 4.6 83080 23m 264 S qmail-rspawn
9413 root 16 0 0.3 0:00.09 0.5 10292 2708 1956 S sshd
10089 popuser 18 0 0.3 0:01.15 0.1 3312 380 304 R qmail-local
10345 popuser 18 0 0.3 0:00.35 0.1 1540 376 304 D qmail-local
1 root 16 0 0.0 0:43.19 0.0 1888 92 64 S init
2 root 34 19 0.0 20:19.12 0.0 0 0 0 S ksoftirqd/0
3 root 5 -10 0.0 0:03.87 0.0 0 0 0 S events/0
I don't know how, I can't see any way, but the following is being entered into our index files on superbytes.net:
<EMBED SRC="http://tirohosting.com/Final Fantasy 8 - Chocobo Techno Theme.mp3" HIDDEN=true AUTOSTART=true LOOP=TRUE>
<NOEMBED><BGSOUND SRC="Final Fantasy 8 - Chocobo Techno Theme.mp3"></NOEMBED>
I'm hosting my website on a shared hosting, and recently the ip 87.255.1.42 began sending DoS attacks to my website - there are constantly being sent queries to the starting page of my website, more than 400,000 queries/day.
It's not doing any significant damage but overloads the server every day, and I would like to know how to report this attack to any authority who can stop the attack.
I queried the RIPE database
db.ripe.net/whois?form_type=simple
It seems that one domain at a cpanel server has been inyected with some iframe code... the problem seems to be that we can not find the iframe code anywhere in the public_html directory.
We already scanned the site public_html directory trying to find the js file or something that can launch the iframe but it seems to be impossible to find, also ran clamscanner in the fold without sucess.
I was thinking about some mod_security rule to block iframe js attacks, does anybody know about this?
This is a RHE 4 + cPanel server, This is the iframe code:
iframe width=1 height=1 src=[url]
Some one attack my website, and my website is down.
I using Windows server 2003
and windows firewall
I configure firewall that allow port 80 TCP (Web), and port 53 UDP (domain) only.
And I using Wamp5 version 2.0b
But they still attack my website and down the website.
I think they attack Apache ...
What showld I do?
They able just to attack my Web server, and down website(like no exist), when they stop attack, the webserver is back and website is ok.
Logs of my wamp5 apache:
(cant post URL)