Howto block DDOS attacks on Ubuntu

Howto block DDOS attacks on Ubuntu - this ariticle shows the usage of PASD .

What is PSAD ? quoted from its home page:
"psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data. "

Other tools from the same host:
fwknop - Single Packet Authorization and Port Knocking.

fwsnort - Application Layer IDS/IPS with iptables.

TPROXY take 6 ?

It seems the TPROXY has been merged into Linux kernel 2.6.27-git2
And it is on 2.6.28-rc6

The corresponding iptables version seems to be released soon (1.4.3-rc1 )

It means no more patch to support this feature in kernel/iptables.

iptables TPROXY target

2007-09-30 20:51:41 GMT, KOVACS Krisztian posted a series of patchs for TPROXY: [PATCH 00/13] Transparent Proxying Patches, Take 3

2007-10-02 20:37:56 GMT, KOVACS Krisztian: Transparent proxy patches, take 4 - userspace
2007-10-02 20:39:42 GMT, KOVACS Krisztian: [PATCH 00/13] Transparent Proxying Patches, Take 4

2007-10-13 17:28:57 GMT, KOVACS Krisztian posted a series of patchs for TPROXY: [PATCH 00/14] Transparent Proxying Patches, Take 5

there is a lot of patches in http://people.netfilter.org/hidden/tproxy/

Squid (WWW Proxy Server)/TPROXY Rules

Transparent Proxy with Linux and Squid mini-HOWTO

LVS and transparent proxy

[stunnel-users] [stunnel patch] transparent proxy on linux 2.6 using cttproxy patch

fedora download


===========================================================================
RedHat EL5.0 上で kernel2.6(tproxy2.0.6パッチ付き)をビルドする方法(メモ)
Ver1.00 2007/08/31 吉岡
===========================================================================


1. Linux Kernelをkernel.orgから入手・展開
入手元: http://kernel.org/
(ここではlinux-2.6.20.18.tar.bz2を利用)
# cd /usr/src/
# wget http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.20.18.tar.bz2
# tar -jxvf linux-2.6.20.18.tar.bz2

2. tproxyパッチを入手・適用
入手元: http://www.balabit.com/downloads/files/tproxy/obsolete/linux-2.6/cttproxy-2.6.20-2.0.6.tar.gz
# cd /usr/src
# wget http://www.balabit.com/downloads/files/tproxy/obsolete/linux-2.6/cttproxy-2.6.20-2.0.6.tar.gz
# tar -zxvf cttproxy-2.6.20-2.0.6.tar.gz
# mv linux-2.6.20.18 linux-2.6.20.18-tproxy
# cd linux-2.6.20.18-tproxy/
# cat ../linux-2.6.20.18-tproxy/patch_tree/* | patch -p1

3. Kernelを設定
# cd linux-2.6.20.18-tproxy/
# make menuconfig
以下のように設定変更
- General setup
- Local version: (-tproxy)
- Networking
- Networking options
- Network packet filtering framework (Netflter)
- Core Netfilter Configuration
(M) Netfilter connection tracking support
Netfilter connection tracking support
=> (X) "Layer 3 Dependent Connection tracking (OBSOLETE)"
- IP: Netfilter Configuration
(M) Full NAT (NEW)
(M) MASQUERADE target support
(M) REDIRECT target support
[*] NAT reservations support
(M) FTP protocol support
(M) Transparent proxying
(M) tproxy match support
(M) TPROXY target support
- Device Drivers
- Network device support
利用しているインターフェースのドライバを指定
([M]又は[*]で組み込み。)
　 設定が終了したら[Exit]で終了し、設定を保存(Yes)。

4. Kernelのビルド
# make

5. Kernelのインストール
# make modules_install
# cp arch/i386/boot/bzImage /boot/vmlinuz-2.6.20.18-tproxy
# mkinitrd /boot/initrd-2.6.20.18-tproxy.img 2.6.20.18-tproxy
(上書きする場合、mkinitrdに"-f"を追加)

6. grub.confの書き換え
以下のように設定ファイルに変更します。
ファイル: /etc/grub.conf
追加内容:
===================================================
title Red Hat Enterprise Linux Server (2.6.20.18-tproxy)
root (hd0,0)
kernel /vmlinuz-2.6.20.18-tproxy ro root=/dev/VolGroup00/LogVol00 rhgb quiet
initrd /initrd-2.6.20.18-tproxy.img
===================================================

7. マシンをリブートし、ブート時にKernelとして2.6.20.18-tproxyを選択。

8. 以下のFAQに従ってtproxyを設定
■54028: 透過プロキシ型の場合にクライアントのソースIPアドレスを保持することはできますか？
(http://www.f-secure.co.jp/support/html/linux_gw_54028.html)