ccihosting.com
Have questions? Call us.
Panama: (+507) 264.0852

Dos Deflate installation

CCIHosting.com knowledgebase

Installing DOS Deflate to mitigate small SYN attacks

(D)DoS Deflate is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It utilizes the command below to create a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level.

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

IP addresses with over a pre-configured number of connections are automatically blocked in the server’s firewall, which can be direct iptables or Advanced Policy Firewall (APF). (We highly recommend that you use APF on your server in general, but deflate will work without it.)

Installation


1-First of all,we have to download the installer script file, Open the terminal and then type the following command

# wget http://www.inetbase.com/scripts/ddos/install.sh

2- Now, we have to make it executable. This can be done through the following command.

# chmod 777 install.sh
3- Now, after getting the executable permission, we have to run the install.sh file. It will install DOS Deflate in the system.

# ./install.sh

After installation, lets configure settings.

First, lets edit "Deflate" conf:

# nano /usr/local/ddos/ddos.conf

  The config file will look like this one:

##### Paths of the script and other files
PROGDIR="/usr/local/ddos"
PROG="/usr/local/ddos/ddos.sh"
IGNORE_IP_LIST="/usr/local/ddos/ignore.ip.list"
CRON="/etc/cron.d/ddos.cron"
APF="/etc/apf/apf"
IPT="/sbin/iptables"

##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
##### option so that the new frequency takes effect
FREQ=1

##### How many connections define a bad IP? Indicate that below.
NO_OF_CONNECTIONS=150

##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=1

##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1

##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO="root"

##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=3600

The configuration file for (D)DOS-Deflate is /usr/local/ddos/ddos.conf , and by default it should have the following values, if not, change them:

FREQ=1
NO_OF_CONNECTIONS=50
APF_BAN=0 ( 0 if using iptables instead of APF )
KILL=1
EMAIL_TO="your@email.com"
BAN_PERIOD=600

Users can change any of these settings to suit the different need or usage pattern of different servers. It’s also possible to whitelist and permanently unblock (never ban) IP addresses by listing them in /usr/local/ddos/ignore.ip.list file. If you plan to execute and run the script interactively, users can set KILL=0 so that any bad IPs detected are not banned.

Uninstall


# wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
# chmod 0700 uninstall.ddos
# ./uninstall.ddos

Need assistance choosing your right server? We are here to help

Call our sales team at +(507) 264.0852 or talk with us on Live Chat