Simple Dos Attack and Mitigation Demo

Описание: Mitigation Strategies for DoS Attacks

To mitigate DoS attacks on your Apache server you can implement several strategies, such as rate limiting, configuring firewalls, and adjusting Apache settings. Below are detailed steps for setting up basic mitigation rules.

1. Rate Limiting with Apache

You can use the `mod_evasive` module in Apache to provide basic DoS protection by limiting the number of requests a user can make to the server.

Install `mod_evasive`
1. **Open your terminal**.
2. **Install `libapache2-mod-evasive`**:
```bash
sudo apt update
sudo apt install libapache2-mod-evasive
```
3. **Enable the module**:
```bash
sudo a2enmod evasive
```
4. **Configure `mod_evasive`**: Create or edit the configuration file:
```bash
sudo nano /etc/apache2/mods-available/evasive.conf
```
Add the following configuration:
```apache
DOSHashTableSize 3097
DOSPageCount 20
DOSSiteCount 100
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSLogDir "/var/log/mod_evasive"
```
`DOSPageCount`: Maximum requests for the same page within the interval.
`DOSSiteCount`: Maximum requests for the entire site within the interval.
`DOSBlockingPeriod`: Time (in seconds) to block the IP address.

5. **Create the log directory**:
```bash
sudo mkdir /var/log/mod_evasive
sudo chown www-data:www-data /var/log/mod_evasive
```
6. **Restart Apache**:
```bash
sudo service apache2 restart
```
7. **Disable `mod_evasive`**:
```bash
sudo a2dismod evasive
```
Using IPTables
You can also use IPTables to block IP addresses that are sending excessive requests.

1. **Limit requests**:
```bash
sudo iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
```
2. **Remove the limit**:
```bash
sudo iptables -F
```

2. Using UFW (Uncomplicated Firewall)

You can use UFW to configure basic firewall rules on your Ubuntu server to mitigate unwanted traffic.

Install and Configure UFW
1. *Install UFW* (if not already installed):
```bash
sudo apt install ufw
```
2. **Set default policies**:
Deny all incoming connections by default:
```bash
sudo ufw default deny incoming
```
Allow outgoing connections:
```bash
sudo ufw default allow outgoing
```

3. **Allow Apache traffic**:
Allow HTTP (port 80):
```bash
sudo ufw allow 80/tcp
```
Allow HTTPS (port 443) if using SSL:
```bash
sudo ufw allow 443/tcp
```
Limit HTTP requests to prevent DoS attacks:
```bash
sudo ufw limit 80/tcp
```

4. **Enable UFW**:
```bash
sudo ufw enable
```
5. **Disable UFW**:
```bash
sudo ufw disable
```
5. **Check UFW status**:
```bash
sudo ufw status
```

3. Adjust Apache Settings

You can tweak Apache's settings to limit the maximum number of connections, thereby reducing the impact of DoS attacks.

Configure Apache
1. *Open the Apache configuration file* (usually located at `/etc/apache2/apache2.conf` or `/etc/apache2/sites-enabled/000-default.conf`):
```bash
sudo nano /etc/apache2/apache2.conf
```
2. **Set the following directives**:
```apache
IfModule mpm_prefork_module
StartServers 5
MinSpareServers 5
MaxSpareServers 10
MaxRequestWorkers 150
MaxConnectionsPerChild 3000
/IfModule
```
3. **Save and restart Apache**:
```bash
sudo service apache2 restart
```

4. Monitor Traffic

Continuously monitor your Apache logs and network traffic to identify potential threats.

Check Apache Access Logs
You can check the access logs at:
```bash
sudo tail -f /var/log/apache2/access.log
```

Analyze with Wireshark
Use Wireshark to analyze incoming traffic patterns and identify any potential malicious behavior.

Summary

By implementing these strategies:
Rate limiting using `mod_evasive` helps control excessive requests.
Firewall rules via UFW can block unwanted traffic.
Apache settings can be adjusted to handle maximum connections and minimize impact.

These measures will significantly enhance your server's resilience against DoS attacks. Let me know if you need further assistance!