Re: [PLUG] Simple protection against DOS attack

[Tom Haines <hainest@gmail.com>]

Unfotunately this is not an internal problem to us, or that would be the response. This is a hosted situation with several Moodle instances for different schools, so one school's bad kid impacts the other sites responsiveness.

The iptables solution seems promising. We are already using that for a firewall, so we're adding no new moving parts. Although we do have several schools who NAT, so their entire web traffic comes to us from a single IP. It would have to be tuned well. I'm collecting stats from the lighttpd logs to see if this is possible.

On Wed, Sep 19, 2012 at 10:18 AM, Rich Freeman <r-plug@thefreemanclan.net> wrote:

On Wed, Sep 19, 2012 at 8:47 AM, Matt Mossholder <matt@mossholder.com> wrote:
> You could try mod_evasive, instead of mod_security...

There is also mod_expulsion_with_no_refund_and_nasty_note_on_transcript.
 Sometimes the best solution isn't always a technical one.  Certainly
at work that would be our solution to an internal DOS attack.

Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug