Dos атака на сервер
Проблема такова.
Стали держаться очень много коннектов с Апачем.
Конфиг Апача 2.28.
Имею Виртуальный выделенный сервер.
Конфиг таков:
Цитата:
#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 100
#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive Off
#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 300
#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 200
##
## Server-Pool Size Regulation (MPM specific)
##
# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# ServerLimit: maximum value for MaxClients for the lifetime of the server
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule prefork.c>
StartServers 1
MinSpareServers 1
MaxSpareServers 5
ServerLimit 300
MaxClients 300
MaxRequestsPerChild 3000
</IfModule>
# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule worker.c>
StartServers 1
MaxClients 20
MinSpareThreads 1
MaxSpareThreads 1
ThreadsPerChild 25
MaxRequestsPerChild 0
</IfModule>
|
Какие можно комманды использовать в iptables, чтобы предотвратить падение Апача?
Часть пользователей приходиться переводить на 443 порт.
С помощью iptables пытался задать правило:
Цитата:
iptables -A INPUT -p tcp syn .dport 80 -m connlimit .connlimit-above 5 -j REJECTiptables -A INPUT -p tcp syn .dport 80 -m connlimit .connlimit-above 5 -j REJECT
|
На что система потребовала какой-то файл.
А получить его можно лишь перекомпилировав ядро.
Что посоветуете в данном случае? |
