1

I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program wrote by me, and I won't bind the VPS with a domain name, and the VPS won't run everything else, like http and ftp.

However, I am not sure whether using a server fits my project best, since I don't know whether this kind of server will get DDOS'd: is it unlikely to get DDOS'd since it doesn't have a domain name, http, ftp etc.? My project has very limited tolerance on server interruption: more than 5 hours' interruption would be unacceptable.

My deduction is: since it has no domain name, http and ftp, so the attacker would think that this server is not for many users, and thus less interesting to flood.

Improve this question
4
  • 1
    "... more than 5 hours' interruption would be unacceptable." - if this is really not acceptable get a proper service level agreement with appropriate penalties for longer disruption. Also, the availability of your server is not only impacted by a targeted attack against your specific server, but attacks against some other system on the same shared infrastructure will likely impact your system too.
    – Steffen Ullrich
    Commented Aug 28, 2021 at 13:11
  • 2
    Intentional DDoS on a VPS without a Domain is probably not your biggest concern. Unintentional DDoS (depending upon bandwidth) can occur from Bots attempting to brute force detected ports. Use brute force prevention tools such as Fail2ban. I once put up an SSH only server with no domain, in a matter of days I was seeing tens of thousands of brute force attempts per day. Setting up a Fail2ban equivalent dropped the attempts to only a handful.
    – user10216038
    Commented Aug 28, 2021 at 16:14
  • @SteffenUllrich Thank you, I overlooked that VPS is a shared system - that's pretty serious ... I should think it over carefully.
    – Limina102
    Commented Aug 31, 2021 at 16:03
  • @user10216038 Thanks for sharing the experience: that's exactly what I am looking for! I was not sure about how the strength that random DDoS/brute force can be. I have heard a little about Fail2ban, and I think I need to deploy such tools. Such strong random attack is really terrifying.
    – Limina102
    Commented Aug 31, 2021 at 16:10

1 Answer 1

Reset to default
2

Having a domain name or http/ftp services running is irrelevant to getting DDOSed. What is more relevant is who you manage to piss off. People don't just randomly DDOS servers. They do it for some reason, whether it's for profit, revenge against some perceived wrong inflicted on them, or (in the case of very large or critical services) the bragging rights for having taken some big name offline.

Now since this is probably a small project, there is no reason anyone would attempt to DDOS it for the bragging rights. For someone who wants revenge or profit, the fact that your VPS does not have a domain name is largely irrelevant. They can extract the IP address of your VPS from the program you distributed, and send enough traffic to consume all of your bandwidth.

Whether the attacker keeps the attack going for more than 5 hours is entirely dependent on how much resources the attacker has to spare, and how motivated they are to hurt you.

Improve this answer
4
  • True, but .... the VPS uses a shared infrastructure. So every attack on the shared infrastructure might also affect the VPS, even if this specific VPS is not directly attacked but some other system on the same shared infrastructure.
    – Steffen Ullrich
    Commented Aug 28, 2021 at 13:08
  • 1
    @SteffenUllrich True but... not having a domain name or http/ftp still makes no difference. Your risk of getting DDoSed remains exactly the same whether or not you have a domain name.
    – nobody
    Commented Aug 28, 2021 at 13:23
  • I agree that having a domain or IP it makes usually no difference. I don't fully agree with "What is relevant is who you manage to piss off." only, since this is relevant but not the only relevant thing.
    – Steffen Ullrich
    Commented Aug 28, 2021 at 19:11
  • Good point, fixed that.
    – nobody
    Commented Aug 28, 2021 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .