Prevent and Stop DoS or DDoS Attacks on Web Server with (D)DOS-Deflate
All web servers been connected to the Internet subjected to DoS (Denial of Service) or DDoS (Distrubuted Denial of Service) attacks in some kind or another, where hackers or attackers launch large amount connections consistently and persistently to the server, and in advanced stage, distributed from multiple IP addresses or sources, in the hope to bring down the server or use up all network bandwidth and system resources to deny web pages serving or causing website not responding to legitimate visitors.
There are plenty of ways to prevent, stop, fight and kill off DDoS attack, such as using firewall. A low cost, and probably free method is by using software based firewall or filtering service. (D)DoS-Deflate is a free open source Unix/Linux script by MediaLayer that automatically mitigate (D)DoS attacks. It claims to be the best, free, open source solution to protect servers against some of the most excruciating DDoS attacks.
(D)DoS-Deflate script basically monitors and tracks the IP addresses are sending and establishing large amount of TCP network connections such as mass emailing, DoS pings, HTTP requests and more by using “netstat -an | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n” command, which is the symptom of a denial of service attack. When it detects number of connections from a single node that exceeds certain preset limit, the script will automatically uses APF or IPTABLES to ban and block the IPs. Depending on the configuration, the banned IP addresses would be unbanned using APF or IPTABLES (only works on APF v 0.96 or better).
Update: The original DDoS-Deflate by MediaLayer has no longer maintained, however, a fork of it is available on GitHub with improved features. This tutorial has been updated to make use of the DDoS-Deflate fork, with legacy DDoS-Deflate guide available at the end.
Installation and setup of (D)DOS-Deflate on the server is extremely easy. Simply login as root by open SSH secure shell access to the server, and run the the following commands one by one:
wget https://github.com/jgmdev/ddos-deflate/archive/master.zip
unzip master.zip
cd ddos-deflate-master
./install.sh
Uninstallation
To uninstall the (D)DOS-Deflate, run the following commands one by one instead:
cd ddos-deflate-master
./uninstall.sh
DDoS-Deflate installer will automatically detect and install itself as init.d script, systemd service or cron job, and start the DDoS script to check for DDoS attach at regular interval.
Once you hava (D)DoS-Deflate installed, you can modify the config files. You can whitelist host names at /etc/ddos/ignore.host.list, whitelist IP addresses at /etc/ddos/ignore.ip.list and modify the (D)DoS-Deflate configuration at /etc/ddos/ddos.conf.
After you modify the config files, restart the DDoS-Deflate daemon to make the change effective:
systemctl restart ddos
/etc/init.d/ddos restart
service ddos restart
Install Legacy Original D(DoS)-Deflate
to install the (D)DOS-Deflate, run the following commands one by one:
Users can change any of these settings to suit the different need or usage pattern of different servers. It’s also possible to whitelist and permanently unblock (never ban) IP addresses by listing them in /usr/local/ddos/ignore.ip.list file. If you plan to execute and run the script interactively, users can set KILL=0 so that any bad IPs detected are not banned.
Options for (D)DoS-Deflate
Syntax: ddos [OPTIONS]
-h | –help: Show the help screen.
-c | –cron: Create cron job to run the script regularly.
-i | –ignore-list: List whitelisted ip addresses.
-b | –bans-list: List currently banned ip addresses.
-d | –start: Initialize a daemon to monitor connections.
-s | –stop: Stop the daemon.
-t | –status: Show status of daemon and pid if currently running.
-v | –view: Display active connections to the server.
-k | –kill N : Block all ip addresses making more than N connections.
LK is a technology writer for Tech Journey with background of system and network administrator. He has be documenting his experiences in digital and technology world for over 15 years.Connect with LK through Tech Journey on Facebook, Twitter or Google+.
