Re: Can Shorewall Help Me?

Swapnil Jain
Wed, 25 Aug 2010 04:10:44 -0000

You should try implementing IDS, snort or something. That might help
detecting an attack and write a script to block that IP. Also keep your web
server updated with all the security patches.

Swapnil

Sent from my iPhone

On 25-Aug-2010, at 9:26 AM, J and T <j_and_t@hotmail.com> wrote:

Thanks Tom. I also thought of that, but you''re right, that would crash
us as
well. I would think this would be a common problem, but I can''t seem to
find
any solution.

The sad thing is similar attacks are super easy to setup using iframes with
a combination of javascript to make for loop calls in a target window
completely hidden from their visitors. Put that on a few dozen servers and
Web pages and make 100 requests per minute per visitor per page and
you''ll
take down a server in no time. That sucks!

Oh well, I guess we''ll just have to limit our port 80 requests to keep
it
under the crashing point and just block those legit visitors when that limit
is reached. Too bad there are these kinds of people out there.

Thanks again for your time Tom,
John

Date: Tue, 24 Aug 2010 20:30:33 -0700
From: teastep@shorewall.net
To: shorewall-users@lists.sourceforge.net
Subject: Re: [Shorewall-users] Can Shorewall Help Me?

On 8/24/10 7:33 PM, J and T wrote:

> Is there anything Shorewall can do to help us?

You can try per-IP rate limiting but that might end up running your
kernel out of memory if there are truly 1000s of hosts attacking your
system.

-Tom
--
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________


------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program Be
part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________ Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users
worldwide. Take advantage of special opportunities to increase revenue and
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d

_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net