TCP syn flood attacks

This kind of attack assumes that an attacker is sending syn packets to the server but not any ACK packets, because of this breaking the TCP/IP 3-way handshake

1. /etc/sysctl.conf
# Protection SYN flood

net.ipv4.tcp_syncookies = 1 #answers to any SYN packet
net.ipv4.conf.all.rp_filter = 1 #The arp_filter variable tells the kernel whether the IP address should be bound to a specific ARP address or not
net.ipv4.tcp_max_syn_backlog = 1024  # how many SYN requests to keep in memory that we have yet to get the third packet in a 3-way handshake from (requires net.ipv4.tcp_syncookies = 1)

2. reload the new parameters

sysctl -p

Slowloris like attacks

The attack bears the same name as the animal, slow but poisonous. Basically the DOS attacker sends very SLOW requests to the server, header by header, even character by character. The server reserves the required resources to handle the request but it also waits for the request to finish. As a result it won’t take long until all the apache connections are flooded or server memory consumed.

1. /etc/haproxy/haproxy.cfg

timeout http-request 5s

2. restart haproxy

/etc/init.d/haproxy restart

cake/bootstrap.php
replace:

error_reporting(E_ALL & ~E_DEPRECATED);

with

error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT);

cake/libs/debugger.php
after:

$files = $this->trace(array('start' => 2, 'format' => 'points'));

add

if(!isset($files[0]['file'])) return;

here is a little storry, we need to use phpize to prepare the imagick php extension for compiling.
On my server I have multiple php installations and if I use phpize directly it will compile the extension for a wrong version of php. Even if I try using phpize with an absolute path the end result will still be wrong and I’ll get the following errors inside my apache error log:
“PHP Warning: PHP Startup: imagick: Unable to initialize module
Module compiled with module API=20060613
PHP compiled with module API=20090626
These options need to match”

so keeping the story short I backup/rename (temporary) the default php include directory:
3. rename /usr/local/include/php to /usr/local/include/_php (in my case)
I create a symlink inside /usr/local/include/ called php that points to the php include version I whish to compile the imagemagick extension, in this case it will point to /usr/local/php-5.3.2-fcgi/include/php

4. now I continue with:
/usr/local/php-5.3.2-fcgi/bin/phpize

5. I configure with the right php-config file:
./configure –with-php-config=/usr/local/php-5.3.2-fcgi/bin/php-config

6. and the usual
make
make install

7. now check where the imagick.so file was copied to and include it in your php.ini:
extension=/usr/…/extensions/memcache.so

8. start memcache server
memcached -d -u nobody -m 1048 -p 11211 127.0.0.1

9. restart apache
/etc/init.d/httpd restart

I mention that I am using centos 5.3 as OS.

When I tried to execute the make command I got the following error:
“undefined reference to `xmlXPathContextSetCache’” and unfortunately didn’t found an answer on google that will solve my question.

After some trial & error I noticed that inside /usr/lib64 folder I had a symlink called libxml2.so that pointed to libxml2.so.2.6.23. I also had the file libxml2.so.2.6.26.

All I did is to change the symlink to point to the newer version of libxml2. In conclusion the problem seems to be in the libxml2 versions prior to 2.6.26 (2.6.25 and bellow)

I suspected that the problem is one of the plugins but I had at least 50 installed .
In order to see who’s the slowest I opened wp-includes/plugin.php and temprary changed the do_action function to something like this:

function do_action($tag, $arg = '') {
	global $wp_filter, $wp_actions, $merged_filters, $wp_current_filter;
 
	if ( ! isset($wp_actions) )
		$wp_actions = array();
 
	if ( ! isset($wp_actions[$tag]) )
		$wp_actions[$tag] = 1;
	else
		++$wp_actions[$tag];
 
	$wp_current_filter[] = $tag;
 
	// Do 'all' actions first
	if ( isset($wp_filter['all']) ) {
		$all_args = func_get_args();
		_wp_call_all_hook($all_args);
	}
 
	if ( !isset($wp_filter[$tag]) ) {
		array_pop($wp_current_filter);
		return;
	}
 
	$args = array();
	if ( is_array($arg) && 1 == count($arg) && isset($arg[0]) && is_object($arg[0]) ) // array(&$this)
		$args[] =& $arg[0];
	else
		$args[] = $arg;
	for ( $a = 2; $a < func_num_args(); $a++ )
		$args[] = func_get_arg($a);
 
	// Sort
	if ( !isset( $merged_filters[ $tag ] ) ) {
		ksort($wp_filter[$tag]);
		$merged_filters[ $tag ] = true;
	}
 
	reset( $wp_filter[ $tag ] );
 
	do {
		foreach ( (array) current($wp_filter[$tag]) as $the_ ) {
 
			if ( !is_null($the_['function']) ) {
                if($tag=='init') $time_start = microtime(true);
				call_user_func_array($the_['function'], array_slice($args, 0, (int) $the_['accepted_args']));
                if($tag=='init') {
                    $time_end = microtime(true);$time = $time_end - $time_start;
                    echo print_r($the_['function']).' -----  <b>'.$time."</b><br>\n";
                }                
            }
        }
 
	} while ( next($wp_filter[$tag]) !== false );
 
	array_pop($wp_current_filter);
}

after this you’ll be able to see what plugin is eating the most of your time (after each function call you’ll see execution time in bold)

It’s not a mature script just a quick snippet to have a starting point for someone who runs into the same problem.

$this->find(‘all’, …

$logs = $dbo->_queriesLog;
$log = end($logs);
print_r($logs);exit;

2. uninstall mysql, the database files are not removed, but feel free to backup them if you want
check the installed mysql packages
yum list installed | grep -i mysql
and now unsinstall them one by one, in my case:
yum remove MySQL-test.x86_64
yum remove MySQL-shared.x86_64
yum remove MySQL-server.x86_64
yum remove MySQL-devel.x86_64
yum remove MySQL-client.x86_64

3. install yum repository for percona
rpm -Uhv http://www.percona.com/downloads/percona-release/percona-release-0.0-1.x86_64.rpm

4. install percona yum install Percona-Server-client-51 Percona-Server-server-51
LATER UPDATE!!!!
please install the separate rpm from this because later you’ll run into all sort of dependency problems on centos5:

http://www.percona.com/downloads/Percona-Server-5.1/Percona-XtraDB-5.1.43-9.1/RPM/rhel5/x86_64/

you need to use rpm -ivh ~package_name.rpm~

5. now go to whm configuration section and set up mysql not to be updated automatically

6. you may need to recompile php, I needed to do it anyway so I am not sure if it wil work if you won’t compile it

7. start services again
/etc/init.d/httpd start ; /etc/init.d/exim start ; /etc/init.d/pure-ftpd start ; /etc/init.d/dovecot start ; /etc/init.d/cpanel start ; /etc/init.d/lfd start ; /etc/init.d/munin-node start ; /etc/init.d/crond start ; /etc/init.d/mysql start ; /etc/init.d/exim start ; /etc/init.d/portsentry start

8. optionally install percona xbackup
yum install xtrabackup

In order to have imagick class available inside php firstly we need to install ImageMagick-devel:
1. yum install ImageMagick-devel

then, download & extract the imagick pecl package:
2.a. cd ~
2.b. wget http://pecl.php.net/get/imagick-3.0.1.tgz
2.c. tar -xvf imagick-3.0.1.tgz
2.d cd imagick-3.0.1.tgz

here is a little storry, we need to use phpize to prepare the imagick php extension for compiling.
On my server I have multiple php installations and if I use phpize directly it will compile the extension for a wrong version of php. Even if I try using phpize with an absolute path the end result will still be wrong and I’ll get the following errors inside my apache error log:
“PHP Warning: PHP Startup: imagick: Unable to initialize module
Module compiled with module API=20060613
PHP compiled with module API=20090626
These options need to match”

so keeping the story short I backup/rename (temporary) the default php include directory:
3. rename /usr/local/include/php to /usr/local/include/_php (in my case)
I create a symlink inside /usr/local/include/ called php that points to the php include version I whish to compile the imagemagick extension, in this case it will point to /usr/local/php-5.3.2-fcgi/include/php

4. now I continue with:
/usr/local/php-5.3.2-fcgi/bin/phpize

5. I configure with the right php-config file:
./configure –with-php-config=/usr/local/php-5.3.2-fcgi/bin/php-config

6. and the usual
make
make install

7. now check where the imagick.so file was copied to and include it in your php.ini:
extension=/usr/…/extensions/no-debug-non-zts-20090626/imagick.so