Posts

Showing posts from June, 2013

How to trace inode usage?

Here is the command to trace inode usage: # echo "Detailed Inode usage for: $(pwd)" ; for d in `find -maxdepth 1 -type d |cut -d\/ -f2 |grep -xv . |sort`; do c=$(find $d |wc -l) ; printf "$c\t\t- $d\n" ; done ; printf "Total: \t\t$(find $(pwd) | wc -l)\n"

Linux - DDoS Deflate To Block DDoS Attack

(D)DoS Deflate is a shell script developed by Zaf, originally for use on MediaLayer servers to assist in combating denial of service attacks. However, it was seen to be very effective for our purpose and It is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It utilizes the command below to create a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level. # netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n IP addresses with over a pre-configured number of connections are automatically blocked in the server's firewall, which can be direct iptables or Advanced Policy Firewall (APF). (We highly recommend that you use APF on your server in general, but deflate will work without it.) Notable Features: It is possible to white-list IP addresses, via /usr/local/ddos/

KERNEL PARAMETER CONFIGURATION:

# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST MESSAGES SENT TO BROADCAST OR MULTICAST ADDRESSES echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # DONT ACCEPT ICMP REDIRECT MESSAGES echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects # DONT SEND ICMP REDIRECT MESSAGES echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects # DROP SOURCE ROUTED PACKETS echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route # ENABLE TCP SYN COOKIE PROTECTION FROM SYN FLOODS echo 1 > /proc/sys/net/ipv4/tcp_syncookies # ENABLE SOURCE ADDRESS SPOOFING PROTECTION echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter # LOG PACKETS WITH IMPOSSIBLE ADDRESSES (DUE TO WRONG ROUTES) ON YOUR NETWORK echo 1 > /proc/sys/net/ipv4/conf/all/log_martians # DISABLE IPV4 FORWARDING echo 0 > /proc/sys/net/ipv4/ip_forward