My BLOG!

Server Under Heavy DOS Attack Today

Today was a write-off.  The server was down all day.  Loads were above 3 and sometimes upto 9.  The thing that was different today was the memory usage -- most of the day it was above 70%.   No sites were loading. 

I did some research. Looked at the stats.  Suspected the process that was using up all the memory was one that was owned by "nobody" -- a couple hundred instances of it appeared when checking CPU usage in WHM.  This indicated a DOS attack but I wasn't sure.

I had to babysit today and had already committed to it, so today was very bad timing.  My sites were left in the gutter all day.  I spent an hour here and there online looking for a solution.  Sent a message to the provider but as usual no response from them -- I was on my own.  Tried restarting services, especially mysql and apache... even rebooted the server... at times I found the server loads were normal but still no pages were loading.  Another indication of a ddos attack.

Installed iptables in WHM, which apparently should allow me to block an IP address.  I just couldn't figure out how to implement the block, or where.  I assume it's done via SSH but I just couldn't find any documentation online about how to proceed with this.  Learned there are some programs like API, floodgate, and flood-something-or-other that you can install in WHM that use iptables but did not find any "how-to" documentation on these.  Finally, around midnight, I looked in cpanel, checked the error log and found 3 IP addresses to block, and blocked them through the "IP deny manager" right from cpanel.

Rebooted the server and when it came back up... presto... all was well.  Still not sure if it's from what I did in cpanel or if it was just a coincidence -- perhaps just needed another reboot to fix this.  No matter.  One thing is certain: I must spend some major time and educate myself on properly and completely securing my server.  There is a lot of time to be spent, a few perl scripts to be installed, and some command line research and work to be done in SSH -- methods that should further secure my server for greater stability.