DOS attack grief!

I think it's reasonable to null-route only the affected IP… Have you tried talking to Linode about this?

Yes. After about 7 hours downtime they finally agreed to restore my other IP (thank god).

Yes. After about 7 hours downtime they finally agreed to restore my other IP (thank god). So Guspaz, what do you think about question 1? Is there any way to prevent this from happening again or is it just the luck of the draw?

Well, there are things that you do to make your linode more DoS resistant, but nothing you can do to make it DoS proof. There's not much of a window between attacks of a size that you can mitigate yourself and attacks big enough to cause problems for other nodes on the host, so in the end there's not much you can do. Setting up a high-availability type setup can help, in that taking out one of your linodes would not take out the other, but then they can just attack both at the same time.

@myriad:

but now my clients are MAJORLY PISSED that their websites will be out of commission for the next 24 hours.
And how much are these "clients" willing to pay for a 100% guaranteed uptime hosting service?

Use this experience to double check the wording on your service level agreement that you have with your clients and make sure that acts of God and/or the Internet are not covered.

Vonskippy don't get me wrong, I am in no way promising them uninterrupted up time, no one can do that. I am just trying to make sure that I can prevent this from happening again. I totally respect you guys and that is why I am asking for your expert advice. My client was understanding about the need to null-route the IP, but not so understanding of the 24 hour penalty.

I am going to try to set up another Linode for auto-failover and that is going to be (another) learning curve as I have never set one up before. Off to the forums for some tips….

It's impossible to completely survive a DDoS attack if the attacker is determined enough. Script kiddies have taken out Microsoft, Amazon, Wal-Mart, companies with a lot more bandwidth than you can afford.

There are hosts out there that specialize in DDoS mitigation. Linode is not one of them. These hosts try to survive DDoS attacks by throwing massive amounts of bandwidth and hardware at the problem, but even they aren't invincible.

The best you can try to do is limit the damage that they're likely to cause, not the damage that they could cause.

Pretty much what Guspaz says. If someone wants you down, you will be down.

That said, look further into why you were being attacked. What types of sites do your clients run? What software do they run if they allowed to on the box? (IRC eggdrop bots used to be a common target for example.)

Very rarely do DOS's happen for no reason. Something was done to piss someone off. I've seen it as simple as someone dislikes your site and wants it offline. Or someone banned a player from their minecraft server, etc.

But as he said, if someone wants your server down… he will take it down. There are things you can do to prevent it, but if it was enough traffic to take down the host, it's completely out of your hands.

I've been getting a ton off dos attacks on my server. After installing "ddos deflate" it's stopped all of them so far. I get emails to my phone daily every time they try again (they were opening 1000s of connections) and then they are banned for a few hours.

As long as they are using a few IPs you're okay.

But if they are running a distributed attack even ddos deflate won't help.

details here: http://zedomax.com/blog/2009/08/17/web- … -flooding/">http://zedomax.com/blog/2009/08/17/web-server-hack-how-to-use-ddos-deflate-to-protect-against-dos-flooding/

@linodeTail:

But if they are running a distributed attack even ddos deflate won't help.

so, basically, ddos deflate isn't named properly? (the first d is for distributed…)

Would iptables rate limiting mitigate a DOS or DDOS attack?

@glg:

so, basically, ddos deflate isn't named properly? (the first d is for distributed…)
It's named properly. It only deflates (reduces the severity of) the attack. It doesn't stop it, especially if the attack is too big to deflate.

@vonskippy:

acts of God and/or the Internet
I worship thee, almighty Internet! Thou knowst everything, thou art everywhere… :roll:

@jebblue:

Would iptables rate limiting mitigate a DOS or DDOS attack?
It will mitigate a small attack by limiting the use of resources on your server. Once the attack is big enough to flood the connection to your box, you're dead in the water.

@jebblue:

Would iptables rate limiting mitigate a DOS or DDOS attack?

Yes, but you're also limiting traffic on that port as well. So if say they are hitting port 80, you'll be limiting legit traffic as well as dos traffic. If however, they are hitting port say, 25, and you want your website to still work you can rate limit or even block traffic to port 25 and it may help.

However, remember the reason most attacks work if you filter them locally is because theyre either tying up system resources or the return traffic of your client communicating back is enough to kill the connection/system. If the incoming rate of data is > your pipe size, no matter what, local firewall running or not, you'll be down.

Interesting points pclissold and berzerke, it sounds like there needs to be a way for the ISP of a targeted site to send a warning signal to the ISPs of the source sites to tell them to shut down those DDOS people at the source.

@jebblue:

Interesting points pclissold and berzerke, it sounds like there needs to be a way for the ISP of a targeted site to send a warning signal to the ISPs of the source sites to tell them to shut down those DDOS people at the source.

Thats what the abuse@domain.com emails are for i.e. abuse@linode.com

The problem with that is that I've found that sometimes the owner of the net block are the abusers. That's when I add their whole net block to my iptables ban list.

Well thats part of life, some ISPs just don't give a crap. It's rare I email an abuse@ normally only if someone's up to something major or I know the ISP is reputable (i.e. if I saw a linode up to no good)