[Guxi]

Learn how to protect your server from DDoS

What is DDoS?
denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the efforts of one or more people to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet.

Symptoms and manifestations
Unusually slow network performance (opening files or accessing web sites)
Unavailability of a particular web site
Inability to access any web site
Dramatic increase in the number of spam emails received—(this type of DoS attack is considered an e-mail bomb)

Methods of attack
A "denial-of-service" attack is characterized by an explicit attempt by attackers to prevent legitimate users of a service from using that service. There are two general forms of DoS attacks: those that crash services and those that flood services.

A DoS attack can be perpetrated in a number of ways. The five basic types of attack are:

1. Consumption of computational resources, such as bandwidth, disk space, or processor time.
2. Disruption of configuration information, such as routing information.
3. Disruption of state information, such as unsolicited resetting of TCP sessions.
4. Disruption of physical network components.
5. Obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.


DoS Protection via APF, BFD, DDOS and RootKit

Being a web host, your servers are constantly being attacked by hackers by denial-of-service (DoS) and other brute force attacks. There is no foolproof method to stop 100% of all attacks, but there are ways to protect your servers by applying firewall rules, and detecting and banning attacking IPs.

this part of thread makes use of the APF, BFD, DDoS Deflate and RootKit to detect and protect your server from denial-of-service type attacks. To apply those utilities, please follow the instructions below:

To begin installation, login to your server as a root user.

Code:

% ssh -l root [hostname] root@[hostname]'s password: [password] Last login: [Date] from [hostname]

APF -- Advanced Policy-based Firewall

Get the latest source from the rfxnetworks, and install the software.

Code:

# cd /usr/src # mkdir utils # cd utils # wget http://rfxnetworks.com/downloads/apf-current.tar.gz # tar xfz apf-current.tar.gz # cd apf-* # ./install.sh

Read the README.apf and README.antidos for configuration options. Edit the /etc/apf/conf.apf and modify the following lines to your need.

Code:

DEVEL_MODE="0" IG_TCP_CPORTS="21,22,25,53,80,110,143,443,3306" IG_UDP_CPORTS="53,111" USE_AD="1"

By default, APF is setup to run in development mode which flushes firewall rules every 5 minutes. Running in development mode defeats the purpose of running APF, as it will automatically flush every 5 minutes. Configure the Ingress (inbound) TCP and UDP ports that need to be opened. Finally, enable AntiDos by setting USE_AD="1".

Edit the /etc/apf/ad/conf.antidos as you fit necessary, and start the APF firewall.

Code:

# apf --start

BFD -- Brute Force Detection

BFD is a shell script which parses security logs and detects authentication failures. It is a brute force implementation without much complexity, and it works in conjunction with a APF (Advanced Policy-based Firewall).

Code:

## Get the latest source and untar. # cd /usr/src/utils # wget http://rfxnetworks.com/downloads/bfd-current.tar.gz # tar xfz bfd-current.tar.gz # cd bfd-* # ./install.sh

Read the README file, and edit the configuration file located in /usr/local/bfd/conf.bfd.
Find ALERT="0" and replace it with ALERT="1"
Find EMAIL_USR="root" and replace it with EMAIL_USR="username@yourdomain.com"

Edit /usr/local/bfd/ignore.hosts file, and add your own trusted IPs. BFD uses APF and hence it orverrides allow_hosts.rules, so it is important that you add trusted IP addresses to prevent yourself from being locked out.

Code:

## [color=#1E90FF]Start the program.[/color] # /usr/local/sbin/bfd -s

DDoS Deflate

Code:

## Get the latest source # cd /usr/src/utils # mkdir ddos # cd ddos # wget http://www.inetbase.com/scripts/ddos/install.sh # sh install.sh

Edit the configuration file, /usr/local/ddos/ddos.conf, and start the ddos.

Code:

# /usr/local/ddos/ddos.sh -c

RootKit -- Spyware and Junkware detection and removal tool

Go to Rootkit Hunter, and download the latest release.

Code:

## Get the latest source and untar # cd /usr/src/utils # wget http://downloads.rootkit.nl/rkhunter-<version>.tar.gz # tar xfz rkhunter-*.gz # cd rkhunter # ./installer.sh ## run rkhunter # rkhunter -c

Setup automatic protection on System Reboot

Code:

## Edit /etc/rc.d/rc.local ## (or similar file depending on Linux version) ## Add the following lines at the bottom of the file /usr/local/sbin/apf --start /usr/local/ddos/ddos.sh -c

Note:

The SYN Floods and ICMP DDoS may also be prevented by utilizing the Linux traffic control utility (tc). To view setup instructions, please see relevant sections of Linux Advanced Routing & Traffic Control HOWTO.


Notes from the users:

Some of the users experienced following errors while starting APF.

Code:

bash# apf --start

Unable to load iptables module (ip_tables), aborting.

According to Burst and Ryan of r-fx.org, changing the SET_MONOKERN variable in /etc/apf/conf.apf to "1" will correct the problem.


Protect yourself with perl script

First do the Installation of a simple perl script:

Code:

wget http://www.inetbase.com/scripts/ddos/install.sh chmod 0700 install.sh ./install.sh

Uninstalling:

Code:

wget http://www.inetbase.com/scripts/ddos/uninstall.ddos chmod 0700 uninstall.ddos ./uninstall.ddos

When you run this Perl script, it will then run an netstat command check how many times each IP is connected and if there are more then the number of connections you specified then it will automatically run a command in APF for the IP to be banned.




WARNING: This will cost you an enormous amount of money (approx. $5 USD/month for an SSH tunnel), proceed at your own discretion.

Setting up a Socks Server via Putty

1. Download Putty

2. Unfortunately, this is where a little bit of work comes in for you. You have to purchase a VPS (Virtual Private Server) that you can use to route your traffic through, preferably one with DDoS protection, and one that supports SSH Tunneling. After some searching around, I recommend sh3llz.net. The SSH Tunneling option is the one we want.

3. Enter the information of your VPS into Putty, as shown here. Port 22 is standard for SSH.

4. Expand “Connection”, then “SSH”, then “Tunnels”, and then add “8080″ to where it says “Source port”, then check the “Dynamic” bubble below. It should look like this.

Once you’ve entered this information, push “Add”, and then D8080 should show up in the white box.

5. Once you’ve finished this, return to the Session menu, enter whatever name you’d like in the “Saved Sessions” box, and click “Save”.

6. Now click “Open” on Putty. A black box should come up prompting you for a user name/password, which will vary based on the service you set up. You might have to click “Accept” or “Okay” on another box that comes up first; this is normal.

Congratulations, now you’re connected to your VPS via SSH tunneling. You’re able to share this with as many people as you’d like, too, as long as you don’t go over your monthly bandwidth. Skype conversations don’t require very much bandwidth, but I’d recommend staying away from video calling or screen sharing, as that could eat up your bandwidth rather quickly.


Use proxy
If you use proxy servers, you will cut DDoS attack in very start, As attacker cannot resolve your real ip he will not be able to DDoS you.

Here is free proxy list

[Invulner]

great buddy thank you very much for this tutorial im gona try this one

cheers!

[Shining White]

Nice and important thread ,

[Nailo]

handy stuff though the blue color of the text hurts my eyes

[H4R0015K]

Nice thread but you must give credit to original author too
www.destinysc2.com/how-to-prevent-a-ddos-specifically-in-regards-to-the-wonderful-program-known-as-skype/