☰

预防DDOS攻击

tag-icon • tag-icon security
预防DDOS攻击

我认为我遭受了 DDOS 攻击，我在我的 access.log 上发现了以下几行：

41.214.156.122 - - [21/Mar/2016:06:01:40 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:40 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:40 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:44 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
41.143.48.239 - - [21/Mar/2016:06:01:43 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:43 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:44 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
41.214.156.122 - - [21/Mar/2016:06:01:44 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
41.143.48.239 - - [21/Mar/2016:06:01:44 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:45 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
105.154.196.147 - - [21/Mar/2016:06:01:45 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
41.143.48.239 - - [21/Mar/2016:06:01:46 +0300] "POST / HTTP/1.1" 200 41765 "-" "Dalvik/2.1.0 (Linux; U; Android 5.1.1; SM-J700F Build/LMY48B)"
::1 - - [21/Mar/2016:06:01:52 +0300] "OPTIONS * HTTP/1.0" 200 110 "-" "Apache/2.4.12 (Ubuntu) (internal dummy connection)"
::1 - - [21/Mar/2016:06:01:53 +0300] "OPTIONS * HTTP/1.0" 200 110 "-" "Apache/2.4.12 (Ubuntu) (internal dummy connection)"

我怎样才能防止此类攻击？

谢谢

答案1

根据你是否正在运行服务器，有不同的选项可以帮助你阻止 IP。现在有一个很好的教程来阻止 IP这里。

您还可以：

  1. 看http://bodhizazen.com/Tutorials/iptables#Additional_Tips（向下滚动到“使用 iptables 拒绝/阻止失败的连接”）。

  2. 保护你的服务器，因服务器而异，对于 ssh 请参阅 -http://bodhizazen.com/Tutorials/SSH_security

  3. 使用以下服务失败2ban。

您可以采取多种措施来提高安全性（这是一个简短的列表）。有关更多信息，请参阅各种安全指南

https://wiki.ubuntu.com/BasicSecurity

https://help.ubuntu.com/lts/serverguide/security.html

部分来自菩提禅对我的帖子的回答这里。

相关内容