防止SYN攻擊

最近防火牆怪怪的，發現是架的網站被攻擊把防火牆操掛了.
上網找了幾個調校方式，在這邊記錄一下.
調整sysctl前三項效果就蠻明顯的，其他的還沒有測試.

vi /etc/sysctl.conf

#開啟SYN Cookies，可防少量SYN攻擊，預設為0=關閉
net.ipv4.tcp_syncookies = 1
#開啟REUSE，把TIME-WAIT Socket拿來再利用於其他TCP連線，預設為0=關閉
net.ipv4.tcp_tw_reuse = 1
#開啟連接快速回收，預設為0=關閉
net.ipv4.tcp_tw_recycle = 1
#把backlog數值由1024增加到2048
net.ipv4.tcp_max_syn_backlog = 2048
#把重試次數由5次減為2次
net.ipv4.tcp_synack_retries = 2

立即套用
#/sbin/sysctl -p

iptable部份調校
例如將SYN請求的次數限制在30次每分鐘，系統默認是5次/秒，顯然太高，同時將burst從默認的5個降低到2個。
將SYN請求次數限制 30次/分(預設是5次/秒)，Burst由5個降為2個.
/sbin/iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 30/m --limit-burst 2 -j ACCEPT

重編核心加入netfilter patch

apt-get install kernel-package

apt-get install linux-source-2.6.18
apt-get install libncurses5-dev
cd /usr/src
tar xvf linux-source-2.6.18.tar.gz
cd /usr/src/linux-source-2.6.18
make menuconfig

/usr/src/linux-source-2.6.18# patch -p1 < kernel-2.6.18-2.6.19-layer7-2.9.patch
patching file include/linux/netfilter_ipv4/ip_conntrack.h
patching file include/linux/netfilter_ipv4/ipt_layer7.h
patching file net/ipv4/netfilter/Kconfig
patching file net/ipv4/netfilter/Makefile
Hunk #1 succeeded at 64 (offset 1 line).
patching file net/ipv4/netfilter/ip_conntrack_core.c
Hunk #1 succeeded at 338 (offset 1 line).
patching file net/ipv4/netfilter/ip_conntrack_standalone.c
Hunk #1 succeeded at 193 (offset 1 line).
patching file net/ipv4/netfilter/ipt_layer7.c
patching file net/ipv4/netfilter/regexp/regexp.c
patching file net/ipv4/netfilter/regexp/regexp.h
patching file net/ipv4/netfilter/regexp/regmagic.h
patching file net/ipv4/netfilter/regexp/regsub.c

make oldconfig (如果之前已經有編譯過 kernel source, 需先執行 make mrproper)
make menuconfig


make bzImage (kernel 2.4 需先執行 make dep)
make modules
make modules_install
make install

iptables

chmod +x ./extensions/.layer7-test
iptables -t mangle -A PREROUTING -m layer7 --l7proto yahoo -j DROP