163 reputation
8
bio website atmoburn.com
location Chile
age 40
visits member for 1 year, 10 months
seen Dec 7 at 22:57

Got born, got drunk, stuck to the concept.


Jun
14
awarded  Nice Question
Dec
22
awarded  Popular Question
Feb
14
comment Apache/Linux server, DoS attack from own IP
I've updated the question with the solution. Unfortunately it's not spectacular at all, just a case of a complex system plus Alzheimer's. :/ Thanks for your help! :-)
Feb
13
revised Apache/Linux server, DoS attack from own IP
added 151 characters in body
Feb
13
comment Apache/Linux server, DoS attack from own IP
You are absolutely correct, just a bit late. :-D
Feb
13
awarded  Scholar
Feb
13
accepted Apache/Linux server, DoS attack from own IP
Feb
13
revised Apache/Linux server, DoS attack from own IP
added 668 characters in body
Feb
13
awarded  Editor
Feb
13
revised Apache/Linux server, DoS attack from own IP
added 233 characters in body
Feb
13
comment Apache/Linux server, DoS attack from own IP
I'm using FilesMatch to give a specific png file the php type. Temporarily gave netstat an suid root to allow the webserver user to also log process IDs for all connections. That, plus the logged client port should identify the culprit. Assuming that it will be an apache process, I also activated mod_status and am appending that output as well. Anxiously waiting for the next occurence. :-D
Feb
13
comment Apache/Linux server, DoS attack from own IP
To elaborate on that last sloppy comment: I'm looking for both the cause and the intention. I'm not looking to cure the symptom, because that means there is still something on my box I don't understand. That would hurt my ego even more than having to ask for help here. :-D Well that, and it would still pose a security risk.
Feb
12
comment Apache/Linux server, DoS attack from own IP
Good point, but that's really a lot for someone who just happened to find a tool on the internet to do his bidding. Now that server runs a social media site that has its share of problems with weirdos and the ban mechanism is quite sophisticated, so I'm sure there's no lack of people with more motivation than knowledge. I'm going to implement Isernis idea and report back. :-)
Feb
12
comment Apache/Linux server, DoS attack from own IP
Great advice, thanks! There's a few images that are almost always part of the attack. I'll replace one of those with a script and see what I can find. :-) I agree that anything beyond a local process seems way too sophisticated for such a non-rewarding goal. AJ Henderson has a point when he says it might just be someone who uses a tool he doesn't understand, but there's just so much a script kiddie tool can do. I'm not really up to speed, but TCP sequence prediction used to be higher magic. :P Will report back! :-)
Feb
12
awarded  Supporter
Feb
12
comment Apache/Linux server, DoS attack from own IP
Sure, but what's the difference if I use htaccess or iptables?
Feb
12
comment Apache/Linux server, DoS attack from own IP
Wait, even if this was mod rewrite, there'd still be two requests, no? One from the original client, one causing the request from the server IP.
Feb
12
comment Apache/Linux server, DoS attack from own IP
I don't think rewrite is involved there. They hit both PHP files and images which are physically present and not being rewritten. I haven't confirmed this, but it is likely that the image urls are taken from the php script that's requested. They fit the folders ....
Feb
12
awarded  Commentator
Feb
12
comment Apache/Linux server, DoS attack from own IP
I'll need to add that trace to the script that blocks the address when it happens. Do you think it's actually realistic to run this with several thousand busy apache children? :(