Hack The Sec-Leading Resource Of Linux Tutorial: DDOS

How to Protect Apache Server From Denial-of-Service (Dos) Attack

<div dir="ltr" style="text-align: left;" trbidi="on">
Protecting Apache Server From Denial-of-Service (Dos) Attack 
A denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. A distributed denial-of-service (DDoS) is where the attack source is more than one, often thousands of, unique IP addresses. It is analogous to a group of people crowding the entry door or gate to a shop or business, and not letting legitimate parties enter into the shop or business, disrupting normal operations. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbvXzbAIVFMdclQaDCSCILQQsJG_oW-jSzbDmSZnd57RAIJ5NuLhrkUjrxXBFx6QNR4K1oia4tvxSmx_7rK5S_50_zR6YwMnhZd7C834Cfq4Z-4-GWZ1HoFotAEJQJeecaIF-G5WN9P3Hx/s1600/ddos_hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbvXzbAIVFMdclQaDCSCILQQsJG_oW-jSzbDmSZnd57RAIJ5NuLhrkUjrxXBFx6QNR4K1oia4tvxSmx_7rK5S_50_zR6YwMnhZd7C834Cfq4Z-4-GWZ1HoFotAEJQJeecaIF-G5WN9P3Hx/s1600/ddos_hackthesec.co.in.png" /></a></div>
 
Criminal perpetrators of DoS attacks often target sites or services hosted on high-profile web servers such as banks, credit card payment gateways; but motives of revenge, blackmail or activism can be behind other attacks. 
 
The scale of DDOS attacks has continued to rise over recent years; web security company, CloudFlare, reported in 2016 they consistently mitigated attacks of 400Gbps. 
What is mod_evasive? 
 
mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_evasive presently reports abuses via email and syslog facilities. 
Installing mod_evasive 
Server Distro: Debian 8 jessie 
Apache Version: Apache/2.4.10 
 
mod_evasive appears to be in the Debian official repository, we will need to install using apt 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># apt-get update
# apt-get install libapache2-mod-evasive</pre>
Setting up mod_evasive 
 
We have mod_evasive installed but not configured, mod_evasive config is located at /etc/apache2/mods-available/evasive.conf. We will be editing that which should look similar to this 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><IfModule mod_evasive20.c>
 #DOSHashTableSize 3097
 #DOSPageCount 2
 #DOSSiteCount 50
 #DOSPageInterval 1
 #DOSSiteInterval 1
 #DOSBlockingPeriod 10

#DOSEmailNotify you@yourdomain.com
 #DOSSystemCommand "su - someuser -c '/sbin/... %s ...'"
 #DOSLogDir "/var/log/mod_evasive"
 </IfModule></pre>
mod_evasive Configuration Directives 
 
<ul style="text-align: left;">
<li>DOSHashTableSize</li>
<li>DOSPageCount</li>
<li>DOSSiteCount</li>
<li>DOSPageInterval</li>
<li>DOSSiteInterval</li>
<li>DOSBlockingPeriod</li>
<li>DOSEmailNotify</li>
<li>DOSSystemCommand</li>
<li>DOSLogDir</li>
</ul>
 
 
This configuration is what I’m using which is working well and I recommend it if you don’t know how to go about the configuration 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><IfModule mod_evasive20.c>
 DOSHashTableSize 2048
 DOSPageCount 5
 DOSSiteCount 100
 DOSPageInterval 1
 DOSSiteInterval 2
 DOSBlockingPeriod 10

DOSEmailNotify you@yourdomain.com
 #DOSSystemCommand "su - someuser -c '/sbin/... %s ...'"
 DOSLogDir "/var/log/mod_evasive"
</IfModule></pre>
As you’ll replace you@yourdomain.com with your email. Since mod_evasive doesn’t create the log directory automatically, we are to create it for it: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># mkdir /var/log/mod_evasive
# chown :www-data /var/log/mod_evasive
# chmod 771 /var/log/mod_evasive</pre>
Once setup is done, make sure mod_evasive is enabled by typing: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># a2enmod evasive</pre>
Restart Apache for changes to take effect 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># systemctl restart apache2</pre>
Testing mod_evasive Setup 
 
mod_evasive set up correctly,  now we are going to test if our web server has protection again DoS attack using ab (Apache Benchmark). Install ab if you don’t have it by typing: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># apt-get install apache2-utils</pre>
Current stat of our /var/log/mod_evasive 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">root@hackthesec:/var/log/mod_evasive# ls -l
 total 0
root@hackthesec:/var/log/mod_evasive#</pre>
We will now send bulk requests to the server, causing a DoS attack  by typing: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># ab -n 100 -c 10 http://serverip/</pre>
Sending 100 request on 10 concurrent requests per request, the current stat of my /var/log/mod_evasive directory is now 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">root@hackthesec:/var/log/mod_evasive# ls -l
 total 4
 -rw-r--r-- 1 www-data www-data 18 May 16 22:10 dos-10.42.0.1</pre>
Checking Apache access logs at /var/log/apache2/access.log we can see all connections from ApacheBench/2.3 were dropped to 403: 
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>

How to Protect Apache Server From Denial-of-Service (Dos) Attack

Protecting Apache Server From Denial-of-Service (Dos) Attack A denial-of-service (DoS) attack is an attempt to make a machine or network r...

How to Secure a CentOS Server SSH + Fail2ban + DDOS Deflate

<div dir="ltr" style="text-align: left;" trbidi="on">
Secure a CentOS Server SSH + Fail2ban + DDOS Deflate 
Secure Shell (SSH) is a UNIX-based command interface and protocol for securely getting access to a remote computer. By default SSH run on port 22. The ideal solution is to change this default value to other port number from 1 to 65535. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjC2UG7hlDw7h6NEQQGMw8cqPEK5fD0hMP9t4uuwh_H3SQD1Hm-N_oUu0QJlFUL5P0IVx0vT-dfNx5mUNDIv_STffytGS1RHx-D35jGzi0s-EurvbZMlIJorVsPQj5HUGyeA_E_1Zjn1pFX/s1600/Blog1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjC2UG7hlDw7h6NEQQGMw8cqPEK5fD0hMP9t4uuwh_H3SQD1Hm-N_oUu0QJlFUL5P0IVx0vT-dfNx5mUNDIv_STffytGS1RHx-D35jGzi0s-EurvbZMlIJorVsPQj5HUGyeA_E_1Zjn1pFX/s400/Blog1.jpg" width="400" /></a></div>
 
Strengthening SSH access 
login to your server via SSH 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">vi /etc/ssh/sshd_config</pre>
Uncommented line that defines the port 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">#Port 22

set this to a port that is not already in use

port 8070</pre>
 
Allow SSH port on Iptables Firewall 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">vi /etc/sysconfig/iptables
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8070 -j ACCEPT
service iptables restart</pre>
Apply this setting 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">/etc/init.d/sshd restart</pre>
SSH will now be listening on newly set port. - 8070 
<div style="text-align: center;">
Prevent bruteforce using Fail2ban and DDOS Deflate</div>
<div style="text-align: left;">
<a href="http://www.fail2ban.org/wiki/index.php/Main_Page">Fail2ban </a>fails to protect against a distributed brute force attack. this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security.</div>
Download and Install Fail2ban  
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-7.noarch.rpm
yum install fail2ban
vi /etc/fail2ban/jail.conf</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">ignoreip = 127.0.0.1
bantime = 240
findtime = 240
maxretry = 10</pre>
You can change as your need. 
Start Fail2ban service 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">service fail2ban start

/etc/init.d/fail2ban start</pre>
<div style="text-align: center;">
 DDOS Deflate</div>
<a href="http://deflate.medialayer.com/" style="font-size: 15px; line-height: 26px;">DoS Deflate</a> is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It utilizes the command below to create a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level. How To Install (D)DoS Deflate :- 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">cd /tmp
wget http://www.inetbase.com/scripts/ddos/install.sh
chmod 0700 install.sh
./install.sh</pre>
How To UnInstall (D)DoS Deflate :- 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
chmod 0700 uninstall.ddos
./uninstall.ddos</pre>
How To Edit Configuration File:- you can set your email for email notification and many more option 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">vi /usr/local/ddos/ddos.conf</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">PROGDIR="/usr/local/ddos"
PROG="/usr/local/ddos/ddos.sh"
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list"
CRON="/etc/cron.d/ddos.cron"
APF="/etc/apf/apf"
IPT="/sbin/iptables"

##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
#####          option so that the new frequency takes effect
FREQ=1

##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=5

##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=1

##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1

##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO="info@hackthesec.co.in"

##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600
</pre>
<div>
 </div>
How To Check The Number Of Connected Ips:- 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">sh /usr/local/ddos/ddos.sh</pre>
How To Restart DDos Deflate:- 
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">sh /usr/local/ddos/ddos.sh -c</pre>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></pre>
</div>