High server loads, and Possible DDOs attacks

Iv pretty much given up, my site has been under constant DDos attacks for the past few days, iv tried multiple things including updating to the newest version of Vb 3.6.8, iv banned multiple ips with 100's of connections each, iv turned on the vbulletin "Server Load Limit" and set it to 10. And still the server is always peaking 90-100% cpu load "but stopped crashing now" with only 400-600 users viewing the forums, this is driving me crasy. One of our competitor sites recently closed down so most of there users came over to my forum so its an important time for me to keep things running smooth and not have the server crashing all the time.

Iv even had to setup a dedicated server because i was banned from 3 shared hosts due to DDos attacks i can't even stop? with no refund, thats compleat bs!

Should this amount of users be causing loads af around 5-10? even seen 90 once

Server specs.

AMD ATHALON XP M 2200+ @ 2.2
1024MB DDR
2x250GB IDE 133
100Mbit UP/DOWN
Ubuntu 7.10
latest apache and php

Regards

[cpvr]

Who's your data center?

[Arbit3r]

Its hosted from home.

[dtv100]

you could try to install and setup :
MODsecurity + MODsecurity Rules+MODevasive+KISS My Firewall

[scoutz]

I've been under http ddos several times, some weeks ago I changed from apache to litespeed, litespeed has nice security features to keep everything running and temporary ban people hammering your server. litespeed keeps up my server under ddos withouth any problems. It's not free but you can try the free trial.

[Romeos Tune]

What about their (litespeed's) claim of being so much faster than Apache? Does this hold true in your opinion scoutz?

[class101]

me when I connect litespeedtech.com it sounds like shitspeed rather than leetspeed huhu

[Brandon Sheley]

you could always just pass protect your root
but it would block search engines as well...

[Alfa1]

Block any service that is not publicly needed for all IP's except your own. (pop3, ftp can easily be used to flood your server with requests) Close any service that you do not need or is not essential. Analyse the logs after every attack and try to prevent the same event happening again. In your position it is wise to trade in functionality for security.
Block IP's that make too many requests. Auto-Kill certain processes at times when your server is under heavy weather.
I have been in the same situation for a long time. My server has much lower specs than yours. On any given day my server is running on 300%, so it has been easy to bring down until it was locked down. Measures like these are not optimal as they will cause errors on your site, but at least your site will be hard to bring down by flooding it with requests.

A large DDoS however is hard to stop. best thing you can have is a host that picks up the phone 24/7 and is on the case swiftly. Look into Anti-DDoS hosting or getting a hardware Anti-DDoS firewall.

[TheRed]

If its the apache or mysql process causing the high load. Then here are my few suggestions on it:

• Try a different my.cnf mysql config file. You can ask Eva2000 for server optimization guidelines on the vBulletin.com forums.
• Install XCache 1.2.1, php 5.2.5.
• Try disabling the plugin system for a few minutes to check if the problem relies on some custom product.
• Set each forum's prune date to equal or less than a week. "Default View Age" option. Helps a lot if you have many threads and millions of posts.
• As a last resource, i would switch from Apache to latest Lighttpd.