So just a random thought as were doing the Info Sec unit on my college course, how would you make a website DDoS proof without cloud-flare? Would it just be case of logging IP address, MAC address and CPU ID then having a script block that IP address for say 5 minutes if 50 or more requests are made per second? Also i know you could use TOR which is why i was thinking the CPU ID rather then just the IP address alone. I also know Botnets are an issue, hence the locking that CPU ID out for 5 minutes. And i know i could (almost) completely air-gap the server but then it would still be open on port 80, 443 and possibly 21 for FTP, so DDoS attacks could still happen on port 443 and 80. I ask because i had a friend DDOS my site while it was up so to protect against it in the future i was thinking to try and write my own script, would this be enough to stop it or would i need more information or what? Also i know i would also have to migrate if a DDoS attack was taking place but if this script could filter the majority of it then that would make it more manageable then at that point my server should be able to keep up in theory.
closed as too broad by Steffen Ullrich, DKNUCKLES, Tobi Nary, Anders, CaffeineAddiction Sep 21 '17 at 13:08
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
There are plenty of tools available to help prevent DDoS attacks but if the attacker is committed and has the resource there is very little you can do. You just need to look at examples like this: https://en.wikipedia.org/wiki/2016_Dyn_cyberattack
One solution if you want a baseline level of protection is install and configure Fail2Ban (https://www.fail2ban.org/wiki/index.php/Main_Page). Set this up to monitor the access-log and ban IP addresses based on:
- ip address/range
- user agent
- requests per second/minute
Using a combination of the above you can create a pretty good filter to dynamically ban IP addresses for any length of time you wish. The more distributed and varied the source of the DOS is the harder this method is to effectively implement.
Also you mention having port 21 open for FTP, I would close this first. FTP is totally insecure. Use SFTP instead.
I would also avoid trying to roll you own protection.