Strategies and Tools for Defending Against DDoS Attacks in Linux

Strategies and Tools for Defending Against DDoS Attacks

1. Introduction

DDoS (Distributed Denial of Service) attacks utilize a large number of controlled computing devices to simultaneously send a massive number of requests to a target server, consuming its resources or bandwidth, resulting in the server being unable to respond to legitimate requests. With the development of the internet, the frequency and scale of DDoS attacks have gradually increased, becoming a significant challenge in the field of cybersecurity. Enterprises and organizations must adopt effective defense strategies and tools to combat this threat.

This article will explore in detail the strategies for defending against DDoS attacks and introduce commonly used defense tools to help administrators enhance the security and stability of their networks.

2. Types of DDoS Attacks

DDoS attacks can be categorized into various types, with common attack methods including:

2.1 Network Layer Attacks (Volumetric Attacks)

These attacks consume bandwidth resources to render the target unable to provide services, with common attack types including UDP flood attacks and ICMP flood attacks.

2.2 Transport Layer Attacks (Protocol Attacks)

This type of attack exploits vulnerabilities in protocols to exhaust server processing resources. Common attack methods include SYN flood attacks and ACK flood attacks.

2.3 Application Layer Attacks (Application Layer Attacks)

Application layer attacks target web servers, databases, and other application services by spoofing a large number of legitimate requests to exhaust service resources. Typical attacks include HTTP flood attacks and Slowloris attacks.

3. Strategies for Defending Against DDoS Attacks

Defending against DDoS attacks requires a multi-faceted approach, employing defense strategies at the network, transport, and application layers to ensure that server and network resources can continue to operate normally during an attack. Here are common defense strategies:

3.1 Network Layer Defense

3.1.1 Increase Bandwidth

Expanding bandwidth can mitigate network layer attacks such as UDP or ICMP flood attacks. While increasing bandwidth cannot completely stop attacks, it can extend the server’s response time, buying time for other defensive measures.

3.1.2 Use Firewalls

Configuring firewalls is one of the foundational measures for DDoS defense. Firewalls can set traffic limit rules to block abnormal network requests and filter out unnecessary traffic.

• iptables example:

# Limit to a maximum of 30 SYN connections per second
sudo iptables -A INPUT -p tcp --syn -m limit --limit 30/second --limit-burst 10 -j ACCEPT

3.1.3 Use Traffic Scrubbing Services

Traffic scrubbing services can redirect traffic to specific devices or third-party services for analysis and filtering when abnormal traffic is detected. Providers like Cloudflare, Akamai, and AWS offer traffic scrubbing features that can filter out malicious traffic during an attack.

3.2 Transport Layer Defense

3.2.1 SYN Cookies

SYN Cookies are an effective mechanism to prevent SYN flood attacks. When the server receives a SYN request, it generates an encrypted SYN Cookie instead of immediately allocating resources for each connection. Resources are only allocated when the client completes the handshake.

To enable SYN Cookies in Linux:

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

3.2.2 Limit TCP Connections

Limiting the maximum number of connections per IP address can effectively prevent DDoS attacks from exhausting server resources.

For example, limit the number of connections per IP using <span>iptables</span>:

sudo iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j REJECT

3.3 Application Layer Defense

3.3.1 Use Web Application Firewalls (WAF)

A WAF is a firewall specifically designed to protect against application layer attacks. It can filter HTTP and HTTPS requests to prevent malicious traffic from attacking web servers. Common WAF solutions include:

• Cloudflare WAF: A cloud-based WAF service that provides real-time DDoS protection.
• ModSecurity: An open-source WAF module that supports Apache, Nginx, and other web servers.

3.3.2 Enable CAPTCHA

For web applications, enabling CAPTCHA (such as Google reCAPTCHA) is an effective means to prevent application layer attacks. It requires users to complete a graphical verification to prevent malicious bots from launching a large number of HTTP requests.

3.3.3 HTTP Request Rate Limiting

By limiting the request rate per IP, HTTP flood attacks can be effectively prevented. Both Nginx and Apache support setting request rate limits.

Nginx example:

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    server {
        location / {
            limit_req zone=one burst=5 nodelay;
        }
    }
}

3.4 Distributed Defense

3.4.1 Use CDN

A Content Delivery Network (CDN) reduces server load by distributing traffic across multiple nodes and provides DDoS protection. Common CDN providers like Cloudflare and Akamai offer DDoS protection features.

3.4.2 Load Balancing

Using load balancers can distribute traffic across multiple servers, preventing a single server from being the target of concentrated attacks. Load balancing can be implemented using tools like HAProxy or Nginx.

Nginx load balancing configuration example:

upstream backend {
    server backend1.example.com;
    server backend2.example.com;
}
server {
    location / {
        proxy_pass http://backend;
    }
}

3.5 Blackhole Routing

When a server is subjected to a large-scale DDoS attack, the traffic may exceed the defense capabilities. In such cases, blackhole routing can be used to drop the attack traffic directly, preventing it from continuing to affect the normal operation of the server.

Configuration example:

sudo ip route add blackhole <attacker IP>

4. DDoS Protection Tools

4.1 Fail2ban

Fail2ban is an open-source intrusion prevention system that can automatically detect and block abnormal traffic or repeated malicious connections.

Installation and Usage:

sudo apt-get install fail2ban  # Debian/Ubuntu systems
sudo yum install fail2ban  # CentOS/RedHat systems

Configure Fail2ban to block repeated SSH connections:

sudo nano /etc/fail2ban/jail.conf
# Enable SSH protection
[sshd]
enabled = true
maxretry = 5

4.2 DDoS Deflate

DDoS Deflate is a lightweight DDoS protection script that can monitor a large number of connections in the system and automatically block IP addresses with high connection counts.

Installation and Usage:

wget https://github.com/jgmdev/ddos-deflate/archive/master.zip
unzip master.zip
cd ddos-deflate-master
./install.sh  # Installation

4.3 CSF (ConfigServer Security & Firewall)

CSF is a powerful firewall management tool that can filter ports and detect and block abnormal traffic, providing DDoS protection.

Installation and Usage:

wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

4.4 Cloudflare

Cloudflare is a cloud-based DDoS protection service that can automatically detect and filter DDoS attacks, providing free DDoS protection services. Users only need to point their domain DNS resolution to Cloudflare to enable DDoS protection features.

5. Conclusion

DDoS attacks are one of the most common threats in cybersecurity today, but through reasonable defense strategies and effective protection tools, the risk of DDoS attacks can be significantly reduced. Defensive measures involve not only increasing system bandwidth, optimizing firewall rules, and enabling WAF, but also using CDN and load balancing in distributed architectures. Additionally, regularly conducting security checks, monitoring network traffic, and timely updating protection tools are also crucial steps in defending against DDoS attacks.

By combining the above strategies and tools, administrators can effectively enhance the DDoS resistance of Linux servers, ensuring the continuous and stable operation of services.

Link: https://blog.csdn.net/weixin_39372311/article/details/142843621?ops_request_misc=%257B%2522request_id%2522%253A%25225995a90042f4743b5cbdde1e0f7a671d%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fall.%2522%257D&request_id=5995a90042f4743b5cbdde1e0f7a671d&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_ecpm_v1~rank_v31_ecpm-6-142843621-null-null.142^v102^pc_search_result_base1&utm_term=ddos%E9%98%B2%E6%8A%A4%E6%96%B9%E6%B3%95linux&spm=1018.2226.3001.4187

(Copyright belongs to the original author, please delete if infringed)

Strategies and Tools for Defending Against DDoS Attacks in Linux