Cakephp 1.3 and php 5.4
April 16, 2012Real IP in apache acces logs whm/cpanel
April 16, 2012Bellow I describe how to avoid some denial of service attacks
TCP syn flood attacks
This kind of attack assumes that an attacker is sending syn packets to the server but not any ACK packets, because of this breaking the TCP/IP 3-way handshake
1. /etc/sysctl.conf
# Protection SYN flood
net.ipv4.tcp_syncookies = 1 #answers to any SYN packet
net.ipv4.conf.all.rp_filter = 1 #The arp_filter variable tells the kernel whether the IP address should be bound to a specific ARP address or not
net.ipv4.tcp_max_syn_backlog = 1024 # how many SYN requests to keep in memory that we have yet to get the third packet in a 3-way handshake from (requires net.ipv4.tcp_syncookies = 1)
2. reload the new parameters
sysctl -p
Slowloris like attacks
The attack bears the same name as the animal, slow but poisonous. Basically the DOS attacker sends very SLOW requests to the server, header by header, even character by character. The server reserves the required resources to handle the request but it also waits for the request to finish. As a result it won’t take long until all the apache connections are flooded or server memory consumed.
1. /etc/haproxy/haproxy.cfg
timeout http-request 5s
2. restart haproxy
/etc/init.d/haproxy restart
