attack related question on domain

J

jessichg

Member

Registered

Apr 8, 2023

#1

Hello,

On shared server, suppose there are large attack on one domain and domain is not using our nameservers, domain is using A record server IP so even we terminated that account, the attack is still large, in that case, even if we terminated account, the domain resolves from server so attack did not get down...

So in that case how to minimize attack on server ?

Thanks

AlbaHost

Well-known member

Moderator

Hosting Provider

Apr 9, 2023

#2

You can't, only solution is to get a server with DDoS protection from other providers. Because even if you hidde your domain/ip throught cloudflare etc, the IP of your server was revealed before. Or if that domain/website does not use the shared IP of your server, then nullroute the mentioned IP to get rid of attacks.

YouStable

Member

Registered

Apr 10, 2023

#3

The best way to prevent such attacks uses CloudFlare + DDoS Protected Data Centres however you get some limitations as well.

J

jessichg

Member

Registered

Apr 10, 2023

#5

jessichg

Yes but without DDOS server, will it possible to limit the attack like modsecurity?

Apr 10, 2023

AlbaHost

Well-known member

Moderator

Hosting Provider

Apr 10, 2023

#6

AlbaHost

One is DoS attack, another one is DDoS attack. DoS attack used by some kids can be mitigated with iptables rules etc, DDoS attack is network based.

Apr 10, 2023

J

jessichg

Member

Registered

Apr 10, 2023

#7

jessichg

yes, question is same related to dos attack, not related to ddos...

On shared server, suppose there are large attack on one domain and domain is not using our nameservers, domain is using A record server IP so even we terminated that account, the attack is still large, in that case, even if we terminated account, the domain resolves from server so attack did not get down...

So in that case how to minimize attack on server ?

AlbaHost

Well-known member

Moderator

Hosting Provider

Apr 10, 2023

#8

AlbaHost

Well you described in your first post "large attack" which i assumed a DDoS attack, however find the IPs in your SSH terminal with command:

Code:

netstat -n

And block them manually with firewall rules, which OS do you have installed on your server?

Apply those rules, but make sure to check if everything is working fine then.

Code:

/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP 
/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP 
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP 
/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP 
/sbin/iptables -t mangle -A PREROUTING -f -j DROP 
/sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset 
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP 
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP 
/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP 
/sbin/iptables -N port-scanning
/sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
/sbin/iptables -A port-scanning -j DROP

Last edited: Apr 10, 2023

J

jessichg

Member

Registered

Apr 10, 2023

#9

jessichg

Let me clear more about....

1) linux server with centos...
2) the attack on domain with different ip, not server ...
3) The attack can minimize if we delete dns zone file so thay domain will not resolve from server
4) But my question is that if domain using A record to point to server so even deleting dns zone, the domain will point to server so in that case how to minimize the attack

AlbaHost

Well-known member

Moderator

Hosting Provider

Apr 10, 2023

#10

AlbaHost

1) linux server with centos...
Alright
2) the attack on domain with different ip, not server ...
The attack cannot be on domain, but on IP! As i've stated in my previous post, if the attack is on different IP and not in main shared servers IP, then nullroute the IP by deleting that IP temporary from your server.
3) The attack can minimize if we delete dns zone file so thay domain will not resolve from server
If you own that domain name sure you can delete the dns zones, but you cant prevent somebody to point the domain to your server's IP if he own the domain in question.
4) But my question is that if domain using A record to point to server so even deleting dns zone, the domain will point to server so in that case how to minimize the attack
I've just provided the clarification and the mitigation that you can take. There is no magic in this case.