From owner-freebsd-stable Tue Aug 22 1:39:58 2000 Delivered-To: freebsd-stable@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 8951F37B423; Tue, 22 Aug 2000 01:39:56 -0700 (PDT) Received: from localhost (kris@localhost) by freefall.freebsd.org (8.9.3/8.9.2) with ESMTP id BAA90627; Tue, 22 Aug 2000 01:39:56 -0700 (PDT) (envelope-from kris@FreeBSD.org) X-Authentication-Warning: freefall.freebsd.org: kris owned process doing -bs Date: Tue, 22 Aug 2000 01:39:56 -0700 (PDT) From: Kris Kennaway To: Domas Mituzas Cc: noor@comrax.com, freebsd-stable@FreeBSD.ORG Subject: Re: DoS attacks and FreeBSD. In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Tue, 22 Aug 2000, Domas Mituzas wrote: > > I have ipfw running on the server, and managed to block the IP's in > > question in time. My question is: suppose I was not near the PC at the > > time of the incident, how can I configure ipfw to automatically block > > cnnections originating from any IP and that is continuous in a suspecious > > manner? (let's say 50 concurrent connections to port 80 every second.) > > Hi, it is possible to set up your ipfw firewall so it logs all setup > connections to any socket, you specify. Therefore, your program or smple > perl script may listen on that socket and make decisions by calling > external program, e.g. ipfw again. Trivial DoS attack of another kind by simply spoofing connection attempts from a valid host and therefore tricking the script into blackholing it. Same may well go for portsentry depending on how it works (I don't know). A much better idea would be to do some kind of application-level rate limiting so that apache doesnt accept more connections from a source than it can handle. I don't know how or if it can do that, though. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message