3

I am often getting DDOS attack from multiple IPs with simple HEAD requests. There are around 30 unique IPs creating such attacks.

201.230.167.68 - [05/Jan/2014:00:19:19 +0530] "HEAD / HTTP/1.1" 301 5.000 0 "-" "-" -  - 
77.121.228.31 - [05/Jan/2014:00:19:19 +0530] "HEAD / HTTP/1.1" 301 4.792 0 "-" "-" -  -
186.64.78.242 - [05/Jan/2014:00:19:19 +0530] "HEAD / HTTP/1.1" 301 5.000 0 "-" "-" -  -
77.121.228.31 - [05/Jan/2014:00:19:20 +0530] "HEAD / HTTP/1.1" 301 5.000 0 "-" "-" -  -
186.23.146.16 - [05/Jan/2014:00:19:20 +0530] "HEAD / HTTP/1.1" 301 5.005 0 "-" "-" -  -
201.230.167.68 - [05/Jan/2014:00:19:21 +0530] "HEAD / HTTP/1.1" 301 5.001 0 "-" "-" -  - 
186.64.78.242 - [05/Jan/2014:00:19:22 +0530] "HEAD / HTTP/1.1" 301 5.001 0 "-" "-" -  -

I would be really thankful if someone can help by giving ideas for preventing such attacks.

|improve this question
  • 1
    Why not just blacklisting those 30 IPs ? – ack__ Apr 15 '14 at 22:03
  • 1
    It looks like it might be a small bot net, I agreewith @ack__, blacklisting the ip addresses is probably the best route – John Apr 15 '14 at 23:11
  • @ack__ Those 30 IPs keeps on changing during every attack. – pradeepchhetri Apr 21 '14 at 7:23
4

Installing fail2ban and configure DoS/DDoS configuration will be solve your problem. It supports rate limiting. And dynamical writes IPTables rules. If you use Red Hat or CentOS use following as root.

yum install fail2ban -y
chkconfig fail2ban on
vim /etc/fail2ban/jail.conf
service fail2ban restart
|improve this answer
  • Most likely fastest & easiest solution. – D. Schalla Jun 2 '14 at 14:18
1

Looking at the timestamps, this is just 1-3 requests per second or so. It should not matter too much for usual operation of typical web server.

Mitigation ideas

There is lot that can be done to mitigate such attacks, but I provide three ideas.

  • STATIC PAGES: Nearly all webservers are more efficient serving static pages. Maybe the front page (/) can be static page?
  • REVERSE PROXY: If the front page of the website is handled by a reverse proxy, the proxy is commonly able to handle simple requests like HEAD efficiently. Handling dynamic pages correctly and efficiently via proxy may require some configuration.
  • On some servers HEAD / takes long as the server processes entire dynamically constructed page and then only provides date and/or length. Maybe the server provides means to handle HEAD / more efficiently than GET /?

The ideas are dependent on amount of DDos traffic not being able to full your entire uplink. Occasionally websites see massive DDos attacks which saturate the bandwidth of their links. In such cases, the tools you can use on your site are not sufficient. The reverse proxy and/or your front page could in such case be served directly by your ISP.

|improve this answer
  • I have shown some logs only to you for one particular webserver. There are lot many HEAD request logs from lots many webservers. – pradeepchhetri Jan 4 '14 at 21:34
1

I disagree with Fail2ban and other log reader + firewall rules things. It doesn't help in this issue since the IP is changing and it seems to be an attack from a botnet and it will create memory + cpu overhead.

You should use web server modules in order to do this, as an example, Nginx provides ngx_http_limit_req_module and Apache provides mod_evasive which have better performance efficiency in my opinion.

|improve this answer
0

If you're not using static IP, reset your router and it should change your IP address. If it does, you're good, if for some reason you can't accomplish this and the attacks become more severe, you can try call your ISP and request them to change your IP because you're being DDose'd.

Depending on situations, but there's really nothing you can do to block those connections, only if you block all connections on that port, (which in most cases would be port 80) but that would prevent you from using HTTP protocol at all.

|improve this answer
  • I think this is a little overkill. If he has domain names pointing to his server, all of those connections will be broken if he requests an IP change. – John Apr 15 '14 at 22:39
  • This question is kinda overdue... but, that's what NO-IP or something like that is for... and btw, he is probably using a Dynamic IP, so, he would have already to do that anyways... no? – SomeNickName Apr 17 '14 at 0:04
0

When I had this problem, all I did was add a couple of entries to my IP tables. If you are running linux, then this is really simple. Run this command for each of the offending ip addresses:

iptables -A INPUT -s IP-ADDRESS -j DROP

This will make sure all packets that come from those ip addresses just get dropped, they will not get processed.

If at all possible, this should be performed at the router level. This will make sure the packets don't even reach your computer. Again this approach won't prevent future attacks, you will have to enter ip addresses that come up from new attackers.

|improve this answer
  • Thanks for the reply. But doing this everytime on all the webservers is not a feasible solution. I totally agree such attacks should be blocked as far as possible. – pradeepchhetri Apr 21 '14 at 7:28
  • Use fail2ban if you in Linux server. – Kasun May 16 '14 at 20:23
0

Like @Kasun said; Fail2ban would probably be your best guess to introduce rate limiting. Another thing, looking at your log above - is that you can disable the HEAD HTTP request. Not sure if it's RFC compliant, but then again.

A quick Google some of those IP addresses seem that they are comment spammers, they'll probably try to figure out what software you're running (wordpress, joomla ...) and exploit it's weaknesses or just spam your site/blog with comments.

From another point of view, if your site is having problems (i.e: having high CPU load) by a few requests, then maybe you should see if you could optimize the site.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.