Linux system how to prevent CC attack

Have you encountered such a situation, the server is running normally, the number of users accessing the website is normal, but the page is very stuck, until the situation of collapse, this situation is mostly CC Attack, prevention is better than cure, the following Xiaobian takes the Linux system as an example to show you how Linux can prevent CC attacks.

What is CC attack

cc attack is simple (ChallengeCollapsar)

principle CC attack is the attacker control of some hosts constantly send large amounts of data packets Causes the other server to run out of server resources until the crash occurs. CC is mainly used to attack the page. Everyone has this experience: when a web page has a large number of visitors, the web page is slow, and CC is to simulate multiple users (how many threads are users). Accessing pages that require a lot of data operations (that is, requiring a lot of CPU time) causes a waste of server resources. The CPU is at 100% for a long time, and there are always connections that cannot be processed until the network is congested, and normal access is aborted.

Prevent CC attack methods

There are two ways to prevent this CC attack

The first is to use the firewall of this machine to solve the firewall that can be installed inside CSF. The drawback is that it can only prevent small-scale CC attacks and DDOS (I stand in Alibaba Cloud, so don't worry too much about DDOS). If the CC attack is fierce, the machine will also run directly on the CUP.

The second way is to add CDN. This method of preventing CC attacks is the best, but CDN generally requires money.

Now let's talk about the specific protection.

First install the CSF firewall. This is relatively simple and you don't need to change the domain name. The small-scale solution will be solved directly.

First, install the dependency package:

yum install perl-libwww-perl perl iptables

Second, download and install CSF:

wget http://www.configserver.com/free/csf.tgz

tar -xzf csf.tgz

cd csf

sh install.sh

Test if CSF works:

[root@localhost csf]# perl /etc/csf/csftest.pl

Testing ip_tables/iptable_filter. .OK

Testing ipt_LOG. .OK

Testing ipt_multiport/xt_multiport. .OK

Testing ipt_REJECT. .OK

Testing ipt_state/xt_state. .OK

Testing ipt_limit/xt_limit. .OK

Testing ipt_recent. .OK

Testing xt_connlimit. .OK

Testing ipt_owner/xt_owner. .OK

Testing iptable_nat/ipt_REDIRECT. .OK

Testing iptable_nat/ipt_DNAT. .OK

RESULT: csf should function on this server

Fourth, csf configuration:

CSF configuration file is

vim /etc/csf /csf.conf

# Allow incoming TCP ports

# It is recommended that you change the default port (22) of SSH to another port, but be sure to add the new port to the next line.

TCP_IN = “20,21,47,81,1723,25,53,80,110,143,443,465,587,993,995〃

# Allow outgoing TCP The same as above, add the SSH login port to the next line.

# In some programs that require a range of ports to be opened, such as Pureftpd's passive mode, you can open ports in the range of 30000-35000 using a mode similar to 30000:35000.

TCP_OUT = <;20,21,47,81,1723,25,53,80,110,113,443〃

# Allow incoming UDP ports

UDP_IN = “20,21,53〃

# Allow outgoing UDP ports

# To allow outgoing traceroute add 33434:33523 to this list

UDP_OUT = “20, 21,53,113,123〃

# Allow incoming PING Whether to allow others to ping your server, the default is 1, allowed. 0 is not allowed.

ICMP_IN = “1〃

These configurations are understood at a glance. Here are a few more commonly used ones:
Previous12Next Total 2 Pages