So just a random thought as were doing the Info Sec unit on my college course, how would you make a website DDoS proof without cloud-flare? Would it just be case of logging IP address, MAC address and CPU ID then having a script block that IP address for say 5 minutes if 50 or more requests are made per second? Also i know you could use TOR which is why i was thinking the CPU ID rather then just the IP address alone. I also know Botnets are an issue, hence the locking that CPU ID out for 5 minutes. And i know i could (almost) completely air-gap the server but then it would still be open on port 80, 443 and possibly 21 for FTP, so DDoS attacks could still happen on port 443 and 80. I ask because i had a friend DDOS my site while it was up so to protect against it in the future i was thinking to try and write my own script, would this be enough to stop it or would i need more information or what? Also i know i would also have to migrate if a DDoS attack was taking place but if this script could filter the majority of it then that would make it more manageable then at that point my server should be able to keep up in theory.

closed as too broad by Steffen Ullrich, DKNUCKLES, Tobi Nary, Anders, CaffeineAddiction Sep 21 '17 at 13:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I propose the question as too broad since the OP did not do any useful previous research (like looking at existing questions). Also, the question is based on strange (and wrong) assumptions like having the MAC and CPU ID from the attacker, the existence of almost air-gapped systems which are still reachable from outside etc. – Steffen Ullrich Sep 21 '17 at 10:03
  • Hold on i'm confused on how this is too broad please explain i will correct it? also i aware that air gapped systems can connect to the outside would still i meant as in having it disconnected from the internet as in physically pulling the Ethernet cable out, i wasn't assuming i had the attackers mac address nor CPU ID that's what the scripts goal is to acquire and log. however air gaping fully would not be useful for a public website, also i have looked at other questions that came up as i was typing out the question name they did not provide what i wanted to know. – matt mods Sep 21 '17 at 10:09
  • "..Would it just be case of logging IP address, MAC address and CPU ID ..." - I cannot interpret this differently as that you assume that you have access to MAC and CPU ID. Also, there is no such thing as almost air-gapped - either there is an air-gap or there is none. – Steffen Ullrich Sep 21 '17 at 10:36
  • This is a good post to read about your suggestion of logging a MAC - stackoverflow.com/questions/3309122/… – iainpb Sep 21 '17 at 10:44
  • alright what i mean is having a script that runs on page load to grab some system information then logs it, i do not mean have access to it before hand i mean have it be collected on page load. And i know there is no such thing as almost air gaped. – matt mods Sep 21 '17 at 10:45

There are plenty of tools available to help prevent DDoS attacks but if the attacker is committed and has the resource there is very little you can do. You just need to look at examples like this: https://en.wikipedia.org/wiki/2016_Dyn_cyberattack

One solution if you want a baseline level of protection is install and configure Fail2Ban (https://www.fail2ban.org/wiki/index.php/Main_Page). Set this up to monitor the access-log and ban IP addresses based on:

  • ip address/range
  • user agent
  • requests per second/minute
  • referrer

Using a combination of the above you can create a pretty good filter to dynamically ban IP addresses for any length of time you wish. The more distributed and varied the source of the DOS is the harder this method is to effectively implement.

Also you mention having port 21 open for FTP, I would close this first. FTP is totally insecure. Use SFTP instead.

I would also avoid trying to roll you own protection.

  • Thank you for your response. I understand that FTP is insure iv'e closed port 22 now. Fail2Ban ill look into it, as for rolling my own protection that was one of those could i do this kind of things i wasn't actually going to roll it just to test if it would work. I know how the more distributed a attack is the harder it is to implement protection on this scale, i guess one way would also be dynamic migration that would be one of the best methods alongside some of the other methods mentioned. – matt mods Sep 21 '17 at 10:16
  • Cool. I assume closing 22 was a typo? Thats your SSH port, you don't want to be closing that. As an aside I would set up key based SSH auth and disable SSH password auth altogether. – Trickycm Sep 21 '17 at 10:20
  • yeah that was a typo i meant port 21, and okay thanks i will set that up in a second. while i'm there ill add O2Auth to my site and SSL. ill also do some pen-testing on it just in case. ill also upvote that answer and mark it :) – matt mods Sep 21 '17 at 10:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.