Server Optimized: Anti DDos for Linux Webserver

Talking about DDos problem, perhaps it would be difficult to make sure that how we can secure 100% before this problem. Because there are so many possible ways to attack dos, ddos, flood, Slowloris ... as well as it comes with a different intensity. So TechBlog solutions presented below will help you in some certain cases only. However, it also will help you strengthen the security of your webserver.
1.DDos restrictions: Dos Deflate
Install Firewall Dos Deflate:

#cd download
#wget <a href="http://www.inetbase.com/scripts/ddos/install.sh" target="_blank">http://www.inetbase.com/scripts/ddos/install.sh</a>
#chmod 0700 install.sh
#./install.sh

After successful installation, you can configure the firewall using the command:

#nano /user/local/ddos/ddos.conf

This is the configuration file of the firewall, the basic content will be as follows:

FREQ=1 // off/ on Firewall (0=off, 1=on)
NO_OF_CONNECTIONS=50 // max connect from 1 IP to server
APF_BAN=1
KILL=1 // tắt/bật (0=off, 1= on)
EMAIL_TO="info@thuvientructuyen.vn"
BAN_PERIOD=600 // time ban IP  600s

2.Apache Mod Antiddos: mod_dosevasive
Install mod_dosevasive:


#up2date -i httpd-devel
#cd /usr/src
#wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
#tar xfz mod_evasive_1.10.1.tar.gz
#cd mod_evasive
#$APACHE_ROOT/bin/apxs -cia mod_evasive20.c




Find the httpd.conf file and add the following text:


<IfModule mod_dosevasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 300
</IfModule>


Then save and restart apache with the following command:

#service httpd restart


or 


#/etc/init.d/httpd restart

3.Install and configure iptables:


Referral information, installing, using TechBlog was presented in detail in the article Configuring Firewall iptables on CentOS / Redhat. In the case of anti ddos, we are only interested in some of the basic rules are as follows:


#Limit the number of incoming tcp connections
#Interface 0 incoming syn-flood protection
#iptables -N syn_flood
#iptables -A INPUT -p tcp --syn -j syn_flood
#iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
#iptables -A syn_flood -j DROP




4.Install mod_antiloris for Apache:

mod_antiloris effect limited connection of every IP requests to the webserver.


#wget ftp://ftp.monshouwer.eu/pub/linux/mod_antiloris/mod_antiloris-0.3.tar.bz2
#tar -jxvf mod_antiloris-0.3.tar.bz2
#cd mod_antiloris-0.3
#sudo /wwwroot/apache2/bin/apxs -a -i -c mod_antiloris.c
#sudo /etc/inid.d/http restart



So basically we have equipped a number of configurations, firewall against DDos. But try to monitor your system regularly to be able to offer appropriate solutions from time to time.