High server loads, and Possible DDOs attacks

Iv pretty much given up, my site has been under constant DDos attacks for the past few days, iv tried multiple things including updating to the newest version of Vb 3.6.8, iv banned multiple ips with 100's of connections each, iv turned on the vbulletin "Server Load Limit" and set it to 10. And still the server is always peaking 90-100% cpu load "but stopped crashing now" with only 400-600 users viewing the forums, this is driving me crasy. One of our competitor sites recently closed down so most of there users came over to my forum so its an important time for me to keep things running smooth and not have the server crashing all the time.

Iv even had to setup a dedicated server because i was banned from 3 shared hosts due to DDos attacks i can't even stop? with no refund, thats compleat bs!

Should this amount of users be causing loads af around 5-10? even seen 90 once

Server specs.

AMD ATHALON XP M 2200+ @ 2.2
1024MB DDR
2x250GB IDE 133
100Mbit UP/DOWN
Ubuntu 7.10
latest apache and php

Regards

[scoutz]

litespeed is much faster then apache, my serverload went from 0.5-1.0 average to 0.0x-0.2. I would suggest to just try the free trial, you'll be satisfied

[dtv100]

Originally Posted by scoutz

litespeed is much faster then apache, my serverload went from 0.5-1.0 average to 0.0x-0.2. I would suggest to just try the free trial, you'll be satisfied

you could try Lighttpd and is free .

[scoutz]

Originally Posted by dtv100

you could try Lighttpd and is free .

lighttpd doesn't offer the security features litespeed does.

[dtv100]

Originally Posted by scoutz

lighttpd doesn't offer the security features litespeed does.

yes after read a little I agree but dont see my self paying for every core in cpu if I understand right .
for now apache2 is my option maybe later if I get a extra box to test would try the free version of litespeed.

[AngelBlue]

Originally Posted by dtv100

you could try to install and setup :
MODsecurity + MODsecurity Rules+MODevasive+KISS My Firewall

Originally Posted by Alfa1

Block any service that is not publicly needed for all IP's except your own. (pop3, ftp can easily be used to flood your server with requests) Close any service that you do not need or is not essential. Analyse the logs after every attack and try to prevent the same event happening again. In your position it is wise to trade in functionality for security.
Block IP's that make too many requests. Auto-Kill certain processes at times when your server is under heavy weather.
I have been in the same situation for a long time. My server has much lower specs than yours. On any given day my server is running on 300%, so it has been easy to bring down until it was locked down. Measures like these are not optimal as they will cause errors on your site, but at least your site will be hard to bring down by flooding it with requests.

A large DDoS however is hard to stop. best thing you can have is a host that picks up the phone 24/7 and is on the case swiftly. Look into Anti-DDoS hosting or getting a hardware Anti-DDoS firewall.

Good advice.

[Jafo232]

You should take a look at your log server log and watch the attack while it is in progress. A lot of times the attack will go after a specific part of the site. Example, an attack constantly hitting the search.php file. If you can find a pattern, writing up a perl script to automatically ban the attacking IP's (using IPTables); it can render small to medium attacks harmless.

[TECK]

Alfa1 is right, you can't do much if you got a DDos attack on your back. You have to wait and let it go basically.
DDOS is done in 2 phases, Intrusion and Distributed DoS. In the first phase the hackers try to compromise weak machines in different networks around the world. It is in the next phase that they install DDOS tools and starts attacking the victims machines/site.

All those companies who say they can actually stop a DDoS attacks... are lieing. If you are dealing with russians who have an army of zombies sitting on the net (Intrusion phase, they have over 10,000 servers to pound your site), you are really screwed... can't do nothing. Small timers, ya, they can be tracked and have their IP's blocked... that's pretty much what DDoS prevention companies do.

Want to see if you deal with a DDoS attack? Run this:

# netstat -lpn | grep :80 | awk '{print $5}' | sort

If more than 5 host/ip connects from the same network then its a clear sign of DDOS.
Block that network using iptables:

# iptables -A INPUT -s <Source IP> -j DROP

Use man iptables to find out more.

The secret to survive to a DDos attack is to use a good load balancer.
The only one I recommend is lighttpd. It will push the requests from specific IP's to a server who will probably crash on a regular bassis, leaving your important cluster nodes free of attacks.

[valdet]

I just checked you site and it seems to have gotten back to its feet.