6

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level.

I read a lot to come to the conclusion that there are three recommended approaches: two modules for Nginx and the option to use a TCP/HTTP load balancer (like HAProxy). The modules I'm referring to are testcookie and anddos. Apparently, you can combine the power of both.

What would you recommend not only from a security perspective but also considering the performance point of view?

2 Answers 2

6

I would also recommend using:

  • ngx_http_limit_req_module to limit RPS, and fallback to 503 on burst cap hit optionally. It does very well with exploited zombie browsers DDoS;
  • agressive caching for anonymous users (with next bullet applied maybe) and for target location (in case it is not random) to eliminate FastCGI passes;
  • use power of LUA module and bash-fu to integrate with iptables, to block zombies on a system level to prevent concurrent UDP/SSH/whatever-flood (you may consider using ipset utility to handle large sets of zombie IPs which iptables will fail to process fast enough).
4
  • Why lua and bash-fu when fail2ban already exists? Jan 5, 2014 at 13:38
  • @Shadur because with LUA-fu one can evaluate more complex ban conditions and filters realtime. Like cookies, additional headers, and maybe some aggregated stats from memcached/redis/RDBMS/etc. fail2ban is quite handy too, but it is not as flexible as nginx+LUA. Jan 5, 2014 at 14:17
  • @НЛО: what approach would you suggest "to block zombies on a system level to prevent concurrent UDP/SSH/whatever-flood"? Jan 8, 2014 at 9:49
  • @thatguyfromoverthere temporarily block zombie IPs with a firewall as a prevention of some other types of attacks. Jan 8, 2014 at 10:42
0

i only know of Roboo, which seems to be the forerunner of the testcookie-thingie. it is not so easy to detect AND protect from ddos on http-level, esp. on high-volume-sites.

if possible you might want to enable proxy_cache which is quite fast. when you're under attack it is possible to gibve a short cache_time like 1 minute.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .