Is there a mod to help with ddos attacks?

[Nick1337]

Not many right now, i bought a new domain and only a few members at a time.. it has to be a ddos attack seeing as it is all coming from the same topic each time.. not that many people is going to go to that topic at a time, and where is the my.cnf file at?

EDIT: I found a temporary cure.. lol i redirected the url /showthread.php?t=28528 to google.com

site is loading fine now

EDIT2: down again

EDIT3: working smooth now just slow at a few times, i been blocking loads of ips in cpanel, everyone who has been viewing the above link

EDIT4: ehhh that makes it so you cant view any topics...

STILL LOOKING FOR SOME HELP,THANKS

[snakes1100]

What makes it so you cant view any topics?

Is cpanel adding these ip's to iptables?

my.cnf should be here /etc/my.cnf

if not, type this from a ssh prompt: find / -name my.cnf -print or locate my.cnf

[Nick1337]

I can't view any topics because i redirected /showthread.php?t=28528 to google.com but it only accepted showthread.php so all topics wont show it goes to google.com

THe only thing in /etc is passwd, quota, and shadow

And no i been banning the ips manually in cpanel

[SEOvB]

DDOs Protection needs to be handled at the server level, and not at vBulletin level, Over in the Security section at WHT (http://www.webhostingtalk.com/forumdisplay.php?f=73) they have tons of articles that could help you.

Have you tried installing a firewall such as APF
some things such as mod_evasive may help as well: http://www.hostgeekz.com/guides/Secu...od_evasive.htm
and secure your sysctl.conf file: http://www.hostgeekz.com/guides/cPan...0hardening.htm

[Nick1337]

I just purchased a VPS so if theres any scripts you know i can install please let me know

[snakes1100]

You can use iptables as i stated earlier to ban IP's at the network level, there is no need to install any scripts.

Did you do a find or locate like i said for my.cnf, that way you can increase the max_connections setting for mysql?

[Nick1337]

No, i couldnt find the file anywhere..

[Marco van Herwaarden]

There is 1 little trick that will stop botnets etc., i use it often on one of my sites when someone goes crazy again and tries the same as described above. Just setup a .htaccess password protection for your forum directory. You can use simple username/password and even mention the user/pass in the login prompt. This will stop botnets for sure in a very cost effective (in terms of resources) way.

Once the attack is over, remove the login again.

[Nick1337]

Originally Posted by Marco van Herwaarden

There is 1 little trick that will stop botnets etc., i use it often on one of my sites when someone goes crazy again and tries the same as described above. Just setup a .htaccess password protection for your forum directory. You can use simple username/password and even mention the user/pass in the login prompt. This will stop botnets for sure in a very cost effective (in terms of resources) way.

Once the attack is over, remove the login again.

Ok I will try that, Thanks Marco van Herwaarden!

[badboyz]

thats what my .hatccess file looks like when some one try to ddos my site

this

RewriteEngine On
RewriteCond %{HTTP_HOST} !^danger-z0ne.net$ [NC]
RewriteCond %{REMOTE_ADDR} ^(.*)$ [NC]
RewriteRule ^(.*)$ http://%1 [R=301,L]

this in this site will stop any dosing program b/c all dosing program don't have reffer on ips
so it will get block auto lol but the bad part of this script is that it also block dial up users lol

other then that rest of the scripts in the quote blow is v gud u can bann the ips blow if u want or change them

just make a .htaccess file in ur root directory and copy n paste and edit the your-site.com to your site


hope this helps enjoy also there is a mod in here that stop the single use form loading ur site too many times in 60 seconds or so i will look up the mod name n post it here

RewriteEngine On
RewriteCond %{HTTP_HOST} !^YOUR-SITE.COM$ [NC]
RewriteCond %{REMOTE_ADDR} ^(.*)$ [NC]
RewriteRule ^(.*)$ http://%1 [R=301,L]

#get rid of bad bots
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^BadBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^EvilScraper [OR]
RewriteCond %{HTTP_USER_AGENT} ^FakeUser
RewriteRule ^(.*)$ http://google.com/

order allow,deny
deny from 68.124.166.191
deny from 68.124.166
deny from 68.125.86.230
deny from 68.125.86
deny from 68.121.22.219
deny from 68.121.22.
deny from 68.121
deny from 24.171.42.17
deny from 24.171
deny from 207.215
deny from 68.124.60
deny from 68.124
deny from 68.246.38.38
deny from 118.136.39.239
deny from 118.136
deny from 68.246
deny from 91.96.66.199
deny from 125.60.235.194
deny from 190.136.126.86
deny from 69.152.235.51
deny from 124.104.180.82
deny from 77.192.77.37
deny from 58.165.6.73
deny from 82.116.149.210
deny from 82.116
deny from 124.106.58.33
deny from 124.106.58
deny from 89.165.61.171
deny from 89.165.61
deny from 81.22.83.245
deny from 195.229.236.215
deny from 118.137.42.251
deny from 83.70.228.90
deny from 86.142.134.73
deny from 65.95.13.105
deny from 74.97.197.180
deny from 91.96.66.199
deny from 125.60.235.194
deny from 64.253.12.205
deny from 190.136.126.86
deny from 213.42.21.153
deny from 124.104.180.82
deny from 77.192.77.37
deny from 58.165.6.73
deny from 82.163.190.172
deny from 207.134.102.142
deny from 74.113.37.178
deny from 99.227.251.79
deny from 82.2.166.185
deny from 69.121.40.142
deny from 71.106.219.75
deny from 83.160.180.211
deny from 71.106.78.77
deny from 71.118.253.15
deny from 202.83.212.243
deny from 82.163.139.144
deny from 194.66.249.18
deny from 78.143.196.114
deny from 68.114.4.0
deny from 216.162.6.228
deny from 172.188.149.212
deny from 41.221.17.223
deny from 71.182.15.239
deny from 216.162.6.228
deny from 84.103.1.208
deny from 86.153.34.228
deny from 124.171.92.14
deny from 69.214.1.18
deny from 72.91.75.158
deny from 209.162.51.19
deny from 66.249.72.52
deny from 211.208.193.102
deny from 24.26.44.148
deny from 66.249.72.52
deny from 202.177.227.98
deny from 86.51.3.211
deny from 86.51.3.195
deny from 86.51.3.210
deny from 86.133.151.43
deny from 86.133.151.43
deny from 124.255.156.140
deny from 121.246.221.22
deny from 87.120.150.240
deny from 66.249.72.226
deny from 83.54.62.218
deny from 41.221.134.204
deny from 124.171.92.14
deny from 78.0.121.39
deny from 99.229
deny from 99.229.134.45
deny from 202.133.73.171
deny from 202.133.73
deny from 90.195.157.165
deny from 90.195
deny from 90.193.236.240
deny from 90.193
allow from all

order allow,deny
deny from 5ac1ecf0.bb.sky.com
deny from 5ac39da5.bb.sky.com
deny from bb.sky.com
deny from 239.39.136.118.fast.net.id
allow from all