Security Basics
Prevent DoS (Linux+Apache+Jboss) Jan 31 2013 03:23PM
Daniel Armbrust (darmbrust cleartech com br) (1 replies)
Re: Prevent DoS (Linux+Apache+Jboss) Feb 02 2013 09:40AM
gremlin gremlin ru (1 replies)
On 31-Jan-2013 13:23:10 -0200, Daniel Armbrust wrote:

> What is the best way to prevent huge access to a web application ?

Is that a flood or just high load?

> This is a Java Application running on Jboss 5. The Operating System
> is a RedHat Linux Box with 4 GB of Ram.

Does the site have some heavy static contents (images etc.)? If yes,
you may like to move the Java stuff into the OpenVZ VPS and set up
the caching frontend (or even several frontends) using nginx.

> Always, we find in access_log a lots of requests. These high requests
> increase the "load average" of the server until its freezes.

How long does it take? Seconds? Minutes? Hours? Days?

> Normally, we pick up the "Bad IP" from access_log and make a simple
> IPTables rule, like that:
> /sbin/iptables -A INPUT -s <IP> -p tcp --syn -m connlimit
> --connlimit-above 5 -j REJECT --reject-with tcp-reset
> There is another best way ???

The simplest way to reduce the flooding effect is

iptables -t filter -A INPUT -p tcp --syn --dport 80 -m recent --update --seconds 60 --hitcount 5 -j REJECT --reject-with tcp-reset
iptables -t filter -A INPUT -p tcp --syn --dport 80 -m recent --set

Obviously, the --seconds and --hitcount parameters may vary for you.
However, after kicking out the flooding bots, your server should be
able to process all the users' requests.

--
Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ðòé gremlin ôþë ru>
GPG key ID: 0xEF3B1FA8, keyserver: hkp://subkeys.pgp.net
GPG key fingerprint: 8832 FE9F A791 F796 8AC9 6E4E 909D AC45 EF3B 1FA8

------------------------------------------------------------------------

Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1
------------------------------------------------------------------------

[ reply ]
Re: Prevent DoS (Linux+Apache+Jboss) Feb 04 2013 12:43PM
Rællic Systems (director raellic com)


 

Privacy Statement
Copyright 2010, SecurityFocus