Re: DDOS problem from Bangkok, Thailand

Hi,

I assume the DoS is coming from multiple machines all hitting you on port
80? If it's from a specific address or range of addresses you should use
ipfw or pf to block it at a firewall level before it hits your machine. Is
the DoS hitting one specific page or a whole bunch of different ones?

Sadly there is very little you may be able to do but if you provide more
information people on this list may be able to help you mitigate the threat
slightly.

Most importantly, you should also consider contacting your upstream
providers so that they can take action.

Cheers,
Marc

On Thu, Mar 6, 2008 at 12:58 PM, kamolpat@xxxxxxxxxxxx <
kamolpat@xxxxxxxxxxxx> wrote:

Dear Security team,

I'm Kamolpat Pornatiwiwat, Sys admin of DMaccess Co., Ltd. I'm got the
problem, My FreeBSD 6.0 got Dos attacked. What should I do? At the
present, I decide to stop apache and leave only mail feature on
functioning. Any guide/recommend/solution will be appreciated.

More detail about my server:
======================
FreeBSD 6.0
apache-1.3.34_4
php5-5.1.2_1
MySQL 5.0.20


php.ini
======
;;;;;;;;;;;;;;;;;;;
; Resource Limits ;
;;;;;;;;;;;;;;;;;;;

max_execution_time = 30 ; Maximum execution time of each script, in
seconds
max_input_time = 60 ; Maximum amount of time each script may spend
parsing r
memory_limit = 32M (at the beginning it is 8M, I change to 32MB since
the cause of httpd-error.log, however, it still the error as the following
showed on httpd-error.log


FILE:/var/log/httpd-error.log
=====================
Allowed memory size of 33554432 bytes exhausted .... happend like this
all over the log

Thanks in Advanced,
Kamolpat Pornatiwiwat,
Sys admin
DMaccess Co., Ltd.




_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx
"




--
Light up the Darkness.
- Bob Marley
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"