DDOS attacks from amazon servers

Well today one of our client server had worst ddos attack against server main IP. While analyzing i found it is coming from amazon hacked servers. As amazon is offering free ec2 servers for 1 year so some of people don’t care about it after getting it as free. They do not use it and forget it after getting it. These servers are easy to get hacked and then can be used to attack other servers by hackers.

Here is the quick solution for linux centos 7 to deal with these attacks:

1. Access your server from ssh, you can use putty

2. Once you logged in with root access you have to install network monitoring tool, i found Trafshow tool very help full to see what IPs are attacking.

3. Install it with :

yum install trafshow -y

if you get nothing found error, just install epel-release repo by executing following command:

yum install epel-release -y

4. Once you install Trafshow, now you are ready to check incoming requests from IPs. Run following below command:

trafshow -i eth0 tcp

where eth0 is network card, you need to change it with your network interface. if you’re not sure about network interface, run following command:

ifconfig

It will return all the interfaces.

5. Once you run command trafshow -i eht0 tcp it will display all the connections with IPs. Here you can block them by various techniques. One is to add these IPs in config Server Firewall.

6. Here is the list of amazon IPs:

https://ip-ranges.amazonaws.com/ip-ranges.json

Read More

Installing mod_evasive for apache in cPanel server

What is mod_evasive ?

Mod_evasive helps apache to protect the server from DDOS attacks and bruteforce attacks, if you are getting too many attacks you should consider installing it on cPanel/WHM based servers. Follow the below steps to install/configure it:

  • Login to your server
  • Execute following commands:
  • # cd /usr/local/src/
  • # wget http://www.zdziarski.com/blog/wp-content/uploads/2010/02/mod_evasive_1.10.1.tar.gz
  • # tar -xvzf mod_evasive_1.10.1.tar.gz
  • # cd mod_evasive
  • # /usr/local/apache/bin/apxs -cia mod_evasive20.c

Now create new file by executing and add the below code into it:

  • # nano /usr/local/apache/conf/mod_evasive.conf

LoadModule evasive20_module modules/mod_evasive20.so
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 10
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
</IfModule>

Now include the above file inside /usr/local/apache/conf/includes/pre_main_global.conf

Include “/usr/local/apache/conf/mod_evasive.conf”

  • Rebuild apache configuration files:
  • # /scripts/rebuildhttpdconf
  • Restart Apache:
  • # service httpd restart

And you’re done!

Let me know if you have any issue while installing/configuring mod_evasive.