Attacks on my server

[Crazy4]

I run a small private Swedish music sharing site.

From the past 3 days, there have been continuous attacks on my server

The httpd sessions are being flooded and the httpd load rises to: 200 - 600

Which makes the server almost inaccessible to everyone.

I think this is a kind of a port flooding or something similar

I am currently using : iptables | CSF

when I do netstat

 1 122.108.26.155
      1 123.125.66.53
      1 125.60.235.227
      1 153.91.179.159
      1 173.34.53.110
      1 189.107.34.88
      1 199.26.172.101
      1 207.255.68.18
      1 68.59.75.67
      1 69.14.246.119
      1 75.70.252.36
      1 85.66.74.97
      1 99.235.95.110
      1 Address
      1 servers)
      2 110.137.110.242
      2 114.120.223.71
      2 117.200.208.97
      2 124.253.162.209
      2 212.46.40.198
      3 110.49.49.16
      3 222.252.86.165
      3 65.37.18.45
      3 71.249.108.199
      4 125.27.164.64
      4 125.99.159.182
      4 76.239.185.200
      4 89.186.120.188
      4 91.36.221.175
      5 115.252.44.80
      5 202.162.200.2
      5 24.16.253.143
      5 58.9.139.83
      6 118.68.252.39
      6 122.169.241.132
      6 124.83.27.159
      6 203.98.112.166
      6 58.168.212.160
      6 67.106.77.21
      7 222.155.207.243
      8 114.128.121.99
     10 114.143.57.17
     16 118.90.34.106
     18 121.98.182.15
     18 86.171.230.35
     46 127.0.0.1

I would really appreciate if any of you could take an initiative to help me out, if things go well enough.. I might even donate to you for helping me out

Awaiting Response,
Crazy4

Crazy4 Reviewed by Crazy4 on 26th Oct 2009. Attacks on my server I run a small private Swedish music sharing site. From the past 3 days, there have been continuous attacks on my server The httpd sessions are being flooded and the httpd load rises to: 200 - 600 Which makes the server almost inaccessible to everyone. I think this is a kind of a port flooding or something similar Rating: 5

[Xman]

i don't believe that is a flood really

if i am correct a flood is many connections from an ip

in which then in ssh you use this command

iptables -I INPUT -s IPHERE -j DROP

replace IPHERE with the current IP you want to drop

[BlaZe]

Just close down your Server for about 2-3 days.

This will help you for sometime.

But Install some Anti-DDos Security on the Server.
I would suggest you to give the Tight Security work to Professional Technicians.
As you cannot compromise the security.

Hope this helps you out

=========
EDIT:
Alternately, you can see this article
Limit IP Connections on Linux

[Crazy4]

Thank you for replying, bt I am unable to find someone that professional and trusted.

But Install some Anti-DDos Security on the Server.

Any recommendations?

[EvilGenius]

just use the iptables method above.

[BlaZe]

Thank you for replying, bt I am unable to find someone that professional and trusted.



Any recommendations?

Yes.
(D)DoS-Deflate (Effective DoS Protection)

Better if you don't compromise on Security. If you are expert, then you can do it, else look at the thread below.
Server Management Company List

[Crazy4]

Thanks,

Any other Anti-DDOS Paid/Free opensource scripts you know of mate?

I really need to get this sorted on time.

Thanks

[Dell23]

in stall server fire wall http://www3.wiredgorilla.com/content/view/274/1/
could be a small DDos

[Crazy4]

In minutes the load goes above 30 - 200

CSF or APF which is the best?

Is there any best commercial one available too?

Appreciate everyone out here

Thanks again

A friend over MSN adviced to put a cron for httpd restart.

Can any one guide me how do I get it working

I added it on crontab -e

but I dont think it restarts

[DXS]

If you have SSH on your server...

netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

type that in and it will give you a list of IPs that are connected and how many connections they have.

If you know you are being attacked and by which IP, simply drop the connection with SSH using:

/sbin/iptables -A INPUT -s 127.0.0.1/16 -j DROP

(replace 127.0.0.1 with the IP address you want dropped).
*I heard the second command bans IPs but I'm not sure but it worked for me...*