7

I have a DigitalOcean Ubuntu 16.04 machine with Bash as main shell, Nginx, PHP-FPM, and MySQL as server environment, Certbot for TLS and WordPress for web applications.

  • I protect from MITMs with TLS.
  • I protect from SSH and application BFAs with SSHGuard and WordFence.
  • I protect from Backdoors and DB injections (like SQL injections) with various policies like minimal usage of modules, simple and unified forms (and captchas and honeypots if needed), and automatic upgrades via unattended-upgrades and WP-CLI for WordPress.
  • If I'm not wrong, WordFence also protects from one or more types of application layer DoS attacks.

Currently I see no reason why the websites I host should be attacked in a Distributed DoS (for example, I hold no organization targeted by another organization).

And yet, I do fear of DoS in general; especially of a Network-Level DoS from a single machine.

My question

What will be the best way to monitor and repel any simple (say, single machine) attack of a network-level DoS?

I would prefer not to use external tools like CloudFlare as their policies can change and they can suddenly cost money or change pricing.

Ideally I would desire to install a Linux utility that works automatically, "as is", monitoring and repelling attackers from iptables (or nftables in the future) but I get the impression such tool isn't available with current technology. UPDATE FOR THIS PASSAGE: It seems that such tool, if existed, wouldn't be enough anyway because I need a network level tool outside the operating system (a tool that DigitalOcean or any similar hosting provider should provide, in my opinion, and that would be controllable from their interface/GUI).

  • 1
    Thanks for editing the question. I don't think that there is some simple tool which you can just use "as is" and forget. But simple DoS attempts done by just rapidly connecting to your site or SYN attacks could be handled by rate limiting new connections which can be done with iptables - see for example askubuntu.com/questions/240360. But you need to fine tune this for the amount of traffic you expect. – Steffen Ullrich May 1 '18 at 5:52
  • 6
    Installing something on the server to prevent network-level attacks is not the way to go. You need something in front of your server on the network level (like a CDN, load balancer, firewall, etc.). – schroeder May 7 '18 at 20:22
  • 3
    Probably the simplest answer is just cloudflare... however that is an off-the-cuff response, hence the comment and not an answer. I agree with @schroeder though - you need something in front of your server to stop network layer attacks, regardless of whether or not they are DDoS or single machine DoS – Conor Mancone May 7 '18 at 20:24
  • 1
    @user9303970 you are kind of asking how to prevent cuts on your skin by placing something under your skin. By the time the protection layer starts to work, the damage has been done. – schroeder May 7 '18 at 20:31
  • 1
    Cloudflare is gratis. I use it for all my sites. You only fear the idea that it might change. Learning iptables is not that difficult. Where did you hear that iptables was going away? – schroeder May 7 '18 at 20:59
4
+250

First of all, user9600383 is right: DDoS is cheap and easy to perform, and you are wrong to discount it.

By network-level attack, I assume you mean an attack at Layer 3 or lower rather than something that targets your site/application directly.

If it is from a single IP address that does not saturate your network path, you could setup Fail2Ban and rate limits. Fail2Ban will take care of protocol abuse (like excessive SSL attempts, which can waste bandwidth and CPU), and rate limits will reduce raw IP traffic.

However, you have a much bigger problem if the attacker is capable of saturating your network connection. The only way to provide reliable service is to have your network provider block the packets on their end.

There is no standard solution for this, and you would have to work with your network provider to determine if an automated solution is even possible. The answer is often "No" based on my experience, but perhaps they offer better support these days. It's been a few years since I worked directly with them.

For a competent DoS/DDoS attacker, most sites are easy targets. The inability of a typical web host to respond meaningfully at the network level gives them a very simple and reliable method of attack.

CloudFlare exists because they can automatically detect an attack and execute countermeasures that are not available to the administrator of a single server. Their bread-and-butter is something that you simply cannot duplicate.

I suggest Fail2Ban and/or rate limits as your best standalone solutions, but they will be inadequate against any halfway decent attacker.

  • From your answer it sounds I must use either CloudFlare, or leave my VPS into a shared server plan that provides defense from these attacks. – user9303970 May 8 '18 at 14:40
  • It is an unfortunate fact of modern netops. Home internet connections are usually fast enough to exhaust a resource that you have no control over. The only solution is to have a third party provide resilience or failover. Most network providers offer very little in practice, so CloudFlare, Incapsula, etc sprouted up. – DoubleD May 8 '18 at 14:48
  • I'm not sure that fail2ban will work on DoS. It would have to find the IPs in the iptables log and then edit iptables to ban the IP. That sounds like a cascading failure to me if the SYN flood is strong from a single IP. – schroeder May 10 '18 at 20:27
  • @schoeder Rate limits would handle that case. As I said at the end, however, even the combination of Fail2Ban and rate limits will be ineffective against a decent attacker. Plus, DDoS rather than single-point DoS is the norm anyway. Still, both Fail2Ban and rate limits are worthwhile on their own merits. I don't really like the goal of the question, and I believe CloudFlare or equivalent is necessary on today's internet unless you're willing to go dark if you piss someone off. – DoubleD May 11 '18 at 14:52
  • @DoubleD go dark and piss someone off? I don't understand. – user9303970 May 11 '18 at 17:47
5

A DoS is different from the other concerns you mention.

With MiTM, zero is the only acceptable number of successful attacks. Zero is the only acceptable number of successful SQL injections. Zero is the only acceptable number of brute forced passwords- and why even subject yourself to password brute forcing, disallow passwords altogether and whitelist IPs.

With DoS...if you are infrastructure supporting commercial customers, then, sure, transient request lossage directly costs money. That's a metric that one can care about.

If the service is best effort, there is probably a level of "successful" DoS that you can ignore. There is a gradation of acceptability for the risk.

To have some insurance, you can apply per-IP rate limits at the network level, e.g. https://making.pusher.com/per-ip-rate-limiting-with-iptables/, and you can apply per-IP rate limits at the application level in nginx, e.g. https://www.nginx.com/blog/rate-limiting-nginx/ or with any rate limit plugin for Wordpress.

But because it's amorphous, distill the concern into a metric that accurately expresses the distinction between caring and not caring for you. This measurement may just be a report from a web ping service giving you an availability score.

5

There is no reason to believe DDoS won't happen & only DoS would. A single attacker, possessing a botnet is enough. Or search engines such as Shodan will help a single infuriated attacker compromise remote machines to launch DDoS.

If you aren't clear about this, Google "DDoS using Memcached servers". You will perhaps get to read about Massive DDoS attacks happened some weeks ago on websites such as Github.

Coming to the solution:

  • As it is already suggested, imposing a per IP limit is a must. For example, if you perform numerous Google Searches in a short period of time, Google will ask to solve the ReCaptcha challenge.

  • I am not sure how Cloudflare DDoS protection works. But oftentimes I have seen it redirecting to site after 5 seconds. It might be possible to prevent DDoS by terminating connections which send arbitrarily large amounts of data. [like in the case of Memcached servers].

  • Assessing your protection measures with all available tools. At least with open source tools such as OWASP ZAP, w3af etc., sometimes a non-distributed simple DoS script such as hulk.py (there is also a modified version on Sourceforge) may be able to break comprehensive security measures.

However, I think while setting a per-IP limit is inevitable to avoid script kiddies etc., it alone can't provide sufficient protection since IP address spoofing is not a very big job, and the probability of DDoS can't be neglected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.