SYN攻擊的簡單防範
系統：CentOS5.4
web架構：LAMP
1.內核參數修改
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_syn_retries=3
net.ipv4.tcp_synack_retries=3
2.iptables防火牆腳本結合計劃任務每5分鐘執行一次
#!/bin/sh
## define some vars
date=`date -d "today" +"%Y%m%d-%H%M"`
MAX_PER_IP_SYN_RECV="30"
MARK="SYN_RECV"
PORT="80"
LOGFILE="/var/log/netstat_$MARK-$PORT"
LOGFILE_IP="/var/log/netstat_connect_ip.log"
DROP_IP_LOG="/var/log/netstat_syn_drop_ip.log"
## initialize
if [ -z $MARK ];then
MARK="LISTEN"
fi
if [ -z $PORT ];then
SPORT="tcp"
else
SPORT=":$PORT"
fi
######################## end
## save the results of command netstat to specifal file
netstat -atun|grep $MARK|grep $SPORT 2>/dev/null >$LOGFILE
REPEAT_CONNECT_IP=`less $LOGFILE|awk '{print $5}'|cut -f1 -d ':'|sort|uniq -d |tee > $LOGFILE_IP`
if [ -f $DROP_IP_LOG ];then
for i in `cat $DROP_IP_LOG|awk -F'#' '{print $1}'`;do
iptables -A INPUT -p ALL -s $i -j DROP
done
fi
for i in `less $LOGFILE_IP`;do
REPEAT_CONNECT_NUM=`grep $i $LOGFILE|wc -l`
## count repeat connections ,if the accout is large than default number,then drop packages
if [ $REPEAT_CONNECT_NUM -gt $MAX_PER_IP_SYN_RECV ];then
echo "$i####$REPEAT_CONNECT_NUM" >> $DROP_IP_LOG
iptables -A INPUT -p ALL -s $i -j DROP
fi
done
cat /var/log/netstat_syn_drop_ip.log >> /data/log/ip
echo " " > /var/log/netstat_syn_drop_ip.log
3.防火牆策略設定
防止SYN攻擊 輕量級預防
iptables -N syn-flood
iptables -A INPUT -p tcp –syn -j syn-flood
iptables -I syn-flood -p tcp -m limit –limit 10/s –limit-burst 20 -j RETURN
iptables -A syn-flood -j REJECT
#防止DOS太多連接進來,可以允許外網網卡每個IP最多15個初始連接,超過的丟棄
iptables -A INPUT -i eth0 -p tcp –syn -m connlimit –connlimit-above 15 -j DROP
iptables -A INPUT -p tcp -m state –state ESTABLISHED,RELATED -j ACCEPT
4.文件描述符設定
ulimit -SHn 102400
5.apache的模式使用worker
<IfModule mpm_worker_module>
ServerLimit 20
ThreadLimit 200
StartServers 5
MinSpareServers 10
MaxSpareServers 50
ThreadsPerChild 100
MaxClients 2000
MaxRequestsPerChild 10000
</IfModule>