Date: 20 Sep 1999 17:23:50 +0200 From: Dag-Erling Smorgrav <des@flood.ping.uio.no> To: "Joao Carlos" <jcarlos@bahianet.com.br> Cc: <stable@FreeBSD.ORG>, <questions@FreeBSD.ORG>, <security@FreeBSD.ORG>, <hitech@bahianet.com.br> Subject: Re: Out of mbuf clusters Message-ID: <xzpso49r4hl.fsf@flood.ping.uio.no> In-Reply-To: "Joao Carlos"'s message of "Sun, 19 Sep 1999 22:51:35 -0300" References: <000501bf030a$ac70e7a0$fa58dfc8@bahianet.com.br>
next in thread | previous in thread | raw e-mail | index | archive | help
"Joao Carlos" <jcarlos@bahianet.com.br> writes:
> I'm running FreeBSD 3.3-STABLE, and compiled a kernel with 64 maxusers. It
> gives me somethink like 1048 processes. I don't know if it's a bug, or
> whatever, but i got crazy when i tested a program called CLONE on a IRC
> Server running i this machine.
> Before arriving 1024 connections on te IRCD, (NOTE: nothing more like httpd,
> squid, etc were running), The machine crashed, with the following message:
I'll bet your CLONE thingy wasn't properly written, and doesn't
actually consume the data sent by the server, causing the server to
fill up mbufs. Currently, FreeBSD panics when it runs out of mbufs.
1) use ircd connection classes to prevent clients from opening more
than a small number of connections, and to limit the size of the
send queue. If you don't know what that means, don't run an IRC
server.
2) increase the number of mbuf clusters. If you don't know how to do
this, don't run an IRC server.
3) set up a heavy firewall in front of your server (preferably on
your border router) which protects your server from SYN floods,
UDP floods, smurfing fingerprinting, etc. If you don't know how to
do this, don't run an IRC server.
4) harden your TCP/IP stack to withstand SYN floods, UDP floods,
smurfing, fingerprinting, etc. Run a recent 4.0, or 3.3-R with my
hardening patches, and understand what those patches do and how to
use them. If you don't know how to do this, don't run an IRC
server.
5) lock your machine down tight, including disabling all services
except ircd and ssh and configuring sshd to only accept
connections from trusted hosts and require RSA authentication (no
rhosts, no password authentication). If you don't know how to do
this, don't run an IRC server.
6) if you need a flooder, try my joiner.pl. Read the source and
understand how it works and how to tune it before using it. Know
that it can (and will) crash your server if you didn't do 1) and
2) properly. If you don't know how to do this, don't run an IRC
server.
DES
--
Dag-Erling Smorgrav - des@flood.ping.uio.no
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?xzpso49r4hl.fsf>