Hack The Sec-Leading Resource Of Linux Tutorial: Apache

Installing HAProxy For Load Blancing And Protecting Apache From DDos

<div dir="ltr" style="text-align: left;" trbidi="on">
HAProxy For Load Blancing And Protecting Apache 
HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Over the years it has become the de-facto standard opensource load balancer, is now shipped with most mainstream Linux distributions, and is often deployed by default in cloud platforms.  
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgPa7Usd4c8YIVUD4JNC30RhJVlkhu9vYhOMa1pF6q2-pKyCbDfhAB_kSKelVuBM10VGpjA3DR0A3F7scFBYZUjAwEe-I1s3UE9n_3Ia-V7fFmwaF2ttWFsjAKi3lCEdkY0TPWvAFBx6L7/s1600/HAProxy-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgPa7Usd4c8YIVUD4JNC30RhJVlkhu9vYhOMa1pF6q2-pKyCbDfhAB_kSKelVuBM10VGpjA3DR0A3F7scFBYZUjAwEe-I1s3UE9n_3Ia-V7fFmwaF2ttWFsjAKi3lCEdkY0TPWvAFBx6L7/s1600/HAProxy-hackthesec.co.in.jpg" /></a></div>
 
Its mode of operation makes its integration into existing architectures very easy and riskless, while still offering the possibility not to expose fragile web servers to the net, such as below : 
<div class="separator" style="clear: both; text-align: center;">
<a href="http://www.haproxy.org/img/haproxy-pmode.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://www.haproxy.org/img/haproxy-pmode.png" /></a></div>
 
version 1.5 : the most featureful version, supports SSL, IPv6, keep-alive, DDoS protection, etc... 
version 1.4 : the most stable version for people who don't need SSL. Still provides client-side keep-alive 
 
version 1.3 : the old stable version for companies who cannot upgrade for internal policy reasons. <a href="http://www.haproxy.org/#desc" target="_blank">More Info Here</a> 
INSTALLATION 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; line-height: 19.2px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">wget http://haproxy.1wt.eu/download/1.5/src/devel/haproxy-1.5-dev7.tar.gz
tar xvfz haproxy-1.5-dev7.tar.gz
$ cd haproxy-1.5-dev7</pre>
Now we have to compile the installation file, we are taking example of centos. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; line-height: 19.2px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">make install</pre>
Now make a new directory and copy haproxy configuration file there 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; line-height: 19.2px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">mkdir /etc/haproxy
cd /etc/haproxy
vi haproxy.cfg</pre>
change the ip address below and copy it to haproxy.cfg 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">global
daemon
maxconn 20000 # count about 1 GB per 20000 connections
pidfile /var/run/haproxy.pid
stats socket /var/run/haproxy.stat mode 600

defaults
mode http
maxconn 19500        # Should be slightly smaller than global.maxconn.
timeout client 60s   # Client and server timeout must match the longest
timeout server 60s   # time we may wait for a response from the server.
timeout queue  60s   # Don't queue requests too long if saturated.
timeout connect 4s   # There's no reason to change this one.
timeout http-request 5s    # A complete request may never take that long.
# Uncomment the following one to protect against nkiller2. But warning!
# some slow clients might sometimes receive truncated data if last
# segment is lost and never retransmitted :
# option nolinger
option http-server-close
option abortonclose
balance roundrobin
option forwardfor    # set the client's IP in X-Forwarded-For.
option tcp-smart-accept
option tcp-smart-connect
retries 2

frontend public
bind 192.168.1.1:80
bind 192.168.1.2:80
bind 192.168.1.3:80
bind 192.168.1.4:80

# table used to store behaviour of source IPs
stick-table type ip size 200k expire 5m store gpc0,conn_rate(10s)

# IPs that have gpc0 > 0 are blocked until the go away for at least 5 minutes
acl source_is_abuser src_get_gpc0 gt 0
tcp-request connection reject if source_is_abuser

# connection rate abuses get blocked
acl conn_rate_abuse  sc1_conn_rate gt 30
acl mark_as_abuser   sc1_inc_gpc0  gt 0
tcp-request connection track-sc1 src
tcp-request connection reject if conn_rate_abuse mark_as_abuser

default_backend apache

backend apache
# set the maxconn parameter below to match Apache's MaxClients minus
# one or two connections so that you can still directly connect to it.
stats uri /haproxy?stats
server srv 0.0.0.0:8181 maxconn 254

# Enable the stats page on a dedicated port (8811). Monitoring request errors
# on the frontend will tell us how many potential attacks were blocked.
listen stats
# Uncomment "disabled" below to disable the stats page :
# disabled
bind :8811
stats uri /
</pre>
<div>
In the above file replace 192.168.1.1 to 192.168.1.4 with your server ip address.</div>
Change your Apache port to 8181 as in configuration file we are using that server srv 0.0.0.0:8181 maxconn 254. 
In WHM goto Tweak Settings and find Apache non-SSL IP/port and change it to 8181. 
Restart apache 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">/etc/init.d/apache2 restart</pre>
Start haproxy 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">haproxy -f /etc/haproxy/haproxy.cfg</pre>
Now we have to check if its working. Go to your stats page to see 
serverip:8811 
 
 
Replace serverip with your server ip used in configuration file and you will see full result generated by haproxy 
<div style="text-align: center;">
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
<div style="text-align: center;">
 </div>
</div>

Installing HAProxy For Load Blancing And Protecting Apache From DDos

HAProxy For Load Blancing And Protecting Apache HAProxy is a free, very fast and reliable solution offering high availability, load balanc...

Installing Mod_Antiloris To Mitigate SlowLoris DOS Attack

<div dir="ltr" style="text-align: left;" trbidi="on">
<h2 style="background-color: white; box-sizing: border-box; font-family: Raleway, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 30px; line-height: 1.1; margin-bottom: 10px; margin-top: 20px;">
Installing Mod_Antiloris To Mitigate SlowLoris DOS Attack</h2>
<div>
In computing, a denial-of-service (<a href="http://www.hackthesec.co.in/search/label/DOS" target="_blank">DoS</a>) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbXyoGw_tVxPwMEaPBFK-7jx-AyZVVx6y5XVv0d_OY6LGrVfWQAug-kvGRptCO4vry43cDykBUs72vkGRas8rdImg3f8zqpr0HNUYdoQ7oGnjufhs8bIe6ncmkA2sgGmI96hWbvRu2nWK9/s1600/dos-attack-hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbXyoGw_tVxPwMEaPBFK-7jx-AyZVVx6y5XVv0d_OY6LGrVfWQAug-kvGRptCO4vry43cDykBUs72vkGRas8rdImg3f8zqpr0HNUYdoQ7oGnjufhs8bIe6ncmkA2sgGmI96hWbvRu2nWK9/s1600/dos-attack-hackthesec.co.in.jpg" /></a></div>
<div>
 </div>
<div>
A distributed denial-of-service (<a href="http://www.hackthesec.co.in/search/label/Ddos%20Attack" target="_blank">DDoS</a>) is where the attack source is more than one, often thousands of, unique IP addresses. It is analogous to a group of people crowding the entry door or gate to a shop or business, and not letting legitimate parties enter into the shop or business, disrupting normal operations.</div>
<div>
<a href="http://www.hackthesec.co.in/2016/05/how-to-protect-apache-server-from-dos-attack.html" itemprop="url" style="background-color: white; display: block; font-family: 'Open Sans', serif, sans-serif; font-size: 18.6px; font-weight: 600; text-decoration: none;"></a><ul style="text-align: left;"><a href="http://www.hackthesec.co.in/2016/05/how-to-protect-apache-server-from-dos-attack.html" itemprop="url" style="background-color: white; display: block; font-family: 'Open Sans', serif, sans-serif; font-size: 18.6px; font-weight: 600; text-decoration: none;"></a>
<li><a href="http://www.hackthesec.co.in/2016/05/how-to-protect-apache-server-from-dos-attack.html" itemprop="url" style="background-color: white; display: block; font-family: 'Open Sans', serif, sans-serif; font-size: 18.6px; font-weight: 600; text-decoration: none;"></a><a href="http://www.hackthesec.co.in/2016/05/how-to-protect-apache-server-from-dos-attack.html" itemprop="url" style="display: inline !important; font-size: 18.6px; text-decoration: none;">How to Protect Apache Server From Denial-of-Service (Dos) Attack</a></li>
</ul>
</div>
<div>
INSTALLATION:-</div>
<div>
Download the installer from sourceforge and install</div>
<div>
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">[root@hackthesec]# cd /usr/local/src

[root@hackthesec]# apxs -a -i -c mod_antiloris.c</pre>
</div>
<div>
Now restart Apache</div>
<div>
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">[root@hackthesec]# service httpd restart</pre>
</div>
<div>
check whether mod_antiloris loaded or not</div>
<div>
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">httpd -M | grep antiloris</pre>
</div>
<div>
Note:- if you are using cpanel server then you have to run the below command to make sure new modification are updated into configuration system file</div>
<div>
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;">/usr/local/cpanel/bin/apache_conf_distiller –update</pre>
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; outline: 0px; overflow: auto; padding: 10px !important; vertical-align: baseline; width: auto !important; word-break: break-all;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></pre>
</div>
</div>

Installing Mod_Antiloris To Mitigate SlowLoris DOS Attack

Installing Mod_Antiloris To Mitigate SlowLoris DOS Attack In computing, a denial-of-service ( DoS ) attack is an attempt to make a machi...

How to Protect Apache Server From Denial-of-Service (Dos) Attack

<div dir="ltr" style="text-align: left;" trbidi="on">
Protecting Apache Server From Denial-of-Service (Dos) Attack 
A denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. A distributed denial-of-service (DDoS) is where the attack source is more than one, often thousands of, unique IP addresses. It is analogous to a group of people crowding the entry door or gate to a shop or business, and not letting legitimate parties enter into the shop or business, disrupting normal operations. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbvXzbAIVFMdclQaDCSCILQQsJG_oW-jSzbDmSZnd57RAIJ5NuLhrkUjrxXBFx6QNR4K1oia4tvxSmx_7rK5S_50_zR6YwMnhZd7C834Cfq4Z-4-GWZ1HoFotAEJQJeecaIF-G5WN9P3Hx/s1600/ddos_hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbvXzbAIVFMdclQaDCSCILQQsJG_oW-jSzbDmSZnd57RAIJ5NuLhrkUjrxXBFx6QNR4K1oia4tvxSmx_7rK5S_50_zR6YwMnhZd7C834Cfq4Z-4-GWZ1HoFotAEJQJeecaIF-G5WN9P3Hx/s1600/ddos_hackthesec.co.in.png" /></a></div>
 
Criminal perpetrators of DoS attacks often target sites or services hosted on high-profile web servers such as banks, credit card payment gateways; but motives of revenge, blackmail or activism can be behind other attacks. 
 
The scale of DDOS attacks has continued to rise over recent years; web security company, CloudFlare, reported in 2016 they consistently mitigated attacks of 400Gbps. 
What is mod_evasive? 
 
mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_evasive presently reports abuses via email and syslog facilities. 
Installing mod_evasive 
Server Distro: Debian 8 jessie 
Apache Version: Apache/2.4.10 
 
mod_evasive appears to be in the Debian official repository, we will need to install using apt 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># apt-get update
# apt-get install libapache2-mod-evasive</pre>
Setting up mod_evasive 
 
We have mod_evasive installed but not configured, mod_evasive config is located at /etc/apache2/mods-available/evasive.conf. We will be editing that which should look similar to this 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><IfModule mod_evasive20.c>
 #DOSHashTableSize 3097
 #DOSPageCount 2
 #DOSSiteCount 50
 #DOSPageInterval 1
 #DOSSiteInterval 1
 #DOSBlockingPeriod 10

#DOSEmailNotify you@yourdomain.com
 #DOSSystemCommand "su - someuser -c '/sbin/... %s ...'"
 #DOSLogDir "/var/log/mod_evasive"
 </IfModule></pre>
mod_evasive Configuration Directives 
 
<ul style="text-align: left;">
<li>DOSHashTableSize</li>
<li>DOSPageCount</li>
<li>DOSSiteCount</li>
<li>DOSPageInterval</li>
<li>DOSSiteInterval</li>
<li>DOSBlockingPeriod</li>
<li>DOSEmailNotify</li>
<li>DOSSystemCommand</li>
<li>DOSLogDir</li>
</ul>
 
 
This configuration is what I’m using which is working well and I recommend it if you don’t know how to go about the configuration 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: 13px; line-height: 1.42857; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;"><IfModule mod_evasive20.c>
 DOSHashTableSize 2048
 DOSPageCount 5
 DOSSiteCount 100
 DOSPageInterval 1
 DOSSiteInterval 2
 DOSBlockingPeriod 10

DOSEmailNotify you@yourdomain.com
 #DOSSystemCommand "su - someuser -c '/sbin/... %s ...'"
 DOSLogDir "/var/log/mod_evasive"
</IfModule></pre>
As you’ll replace you@yourdomain.com with your email. Since mod_evasive doesn’t create the log directory automatically, we are to create it for it: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># mkdir /var/log/mod_evasive
# chown :www-data /var/log/mod_evasive
# chmod 771 /var/log/mod_evasive</pre>
Once setup is done, make sure mod_evasive is enabled by typing: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># a2enmod evasive</pre>
Restart Apache for changes to take effect 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># systemctl restart apache2</pre>
Testing mod_evasive Setup 
 
mod_evasive set up correctly,  now we are going to test if our web server has protection again DoS attack using ab (Apache Benchmark). Install ab if you don’t have it by typing: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># apt-get install apache2-utils</pre>
Current stat of our /var/log/mod_evasive 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">root@hackthesec:/var/log/mod_evasive# ls -l
 total 0
root@hackthesec:/var/log/mod_evasive#</pre>
We will now send bulk requests to the server, causing a DoS attack  by typing: 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># ab -n 100 -c 10 http://serverip/</pre>
Sending 100 request on 10 concurrent requests per request, the current stat of my /var/log/mod_evasive directory is now 
<pre style="background-attachment: scroll; background-clip: initial; background-color: #3c3c3c; background-image: none; background-origin: initial; background-position: 0px 0px; background-repeat: repeat; background-size: initial; border-radius: 4px; border: 1px solid rgb(229, 229, 229); margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">root@hackthesec:/var/log/mod_evasive# ls -l
 total 4
 -rw-r--r-- 1 www-data www-data 18 May 16 22:10 dos-10.42.0.1</pre>
Checking Apache access logs at /var/log/apache2/access.log we can see all connections from ApacheBench/2.3 were dropped to 403: 
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>