Networked Services

Denial of service on Apache
Your NameName of Your Department
Name of Your Institution
Date
Summary
Denial of Service (DoS) attacks are high and sadly up to now there is no way to end the attack. Luckily, there are ways to mitigate them. We shall use a linux based system to carry out the study since it is the most secure operating system yet it is being attacked. We first define relevant terms in the study then look at the vulnerabilities of Apache, checking if your server is under a DoS attack, and the mitigations techniques available up to date. We shall try the mod_evasive mitigation technique and test its impact. We see this technique blocking IP addresses that request a resource
Table of Contents
Summaryi
Introduction2
Definitions
Apache2
Denial of Service2
Apache vulnerabilities2
Types of DoS attacks2
Checking if your linux is under a DoS attack3
Detecting a TCP/IP Denial of Service Attack. 3
Detecting if a UDP denial of Service is targeting the server. 3
Detecting a SYN flood with netstat 4
Ways to mitigating DoS attack in Apache. 4
Mitigating a slow HTTP DoS Attack4
Using traffic-shaping modules4
Usage of third party software 5
Using mod_evasive for Apache 5
Implementation of using mod_evasive for Apache 6
Step 1- Installation of mod_evasive 5
Step 2- Verification of the Installation 6
Step 3- Configuration of mod_evasive 7
Step 4- Load the mod_evasive Module 8
Step 5- A test on mod_evasive 9
Conclusions 10
References 11

Introduction
A system admin who has not faced denial of service in their network or website is a very happy admin. Those unlucky can concur with me that it is a headache and should be done away with once and for all. Up to now, Denial of Service attack has no remedy by it can be reduced. We shall see how to mitigate them and outcome of some mitigation techniques.
The Apache HTTP Server also called Apache colloquially, is currently the number one web software globally. Apache supports features many of which are implemented as compiled modules that extend the nub functionality. These can range from authentication schemes to the support of server-side programming language. Examples of popular languages being supported are Perl, Tcl, Python, and PHP. Some common authentication modules include mod_auth, mod_access, mod_digest and its successor mod_auth_digest.
Denial of service (Dos) assault is an endeavor to counteracting administration to genuine clients. Ordinarily, this is finished by devouring all assets used to give the particular administration. Assets focused on are commonly either a Disk space or Database space, CPU, Bandwidth, and Operating memory (RAM).
Assaults on Apache
Levels of assault on Apache are anything but difficult to perform since they require less data transfer capacity contrasted with different assaults. Transmission capacities of even a couple dozen bytes can complete the assault. This assault is obvious to the point that is the reason less talented assailants decide on this assault.
Apache vulnerabilities
Programming mistakes can be misused to manhandle framework assets. An experience with this weakness was knowledgeable about 1998 were Apache distributed a lot of memories brought about by an uncommonly made little-estimated demand. Another genuine shortcoming is unexploitable cradle flood that can bring about an accident of the server when assaulted. This weakness is regularly not misused since it will trade off the host.
Apache can be running in a prefork mode as it regularly does or not prefork mode. In a prefork mode, there are numerous occasions of the server running in parallel. An accident of a youngster results in its guardian making another kid. An aggressor will need to send tremendous quantities of solicitations ceaselessly to keep the procedure of another tyke being made by its guardian. In a not prefork mode, there is one and only server process. Its pound results in the entire framework going down and in this way occupied.
Types of Dos Attacks
Some Dos attacks are currently disturbing servers. These attacks include UDP Flood, ICMP (Ping) Flood, SYN Flood, Ping of Death, Slowloris, NTP Amplification, HTTP Flood, and the latest version of attack called Zero-day DoS Attack. Most of these attacks affect Apache, but there are ways of curbing them but firstly let us see how to determine if your system is under attack (Zargar et.al, 2013).
Checking if your web server is under attack (DoS)
Detecting a TCP/IP DoS Attack
Netstat is one of an essential command used to check for an attack in a server. We use

In case the output of the above command is a value like 3000 or 4000 connections, then most likely the server is under a DoS attack.
Utilize the accompanying command to see all IPS associated with the Apache server and get a brief insights on the times every IP has been joined with the server:
From the above command output, IP 145.53.103.70 has either had 223 connections to the server or is in the process of connecting to the node.
lsof command is used to determine the number of made connections to apache like so:

Lsof command outputs can be kept updated every second using the gnu watch cmd like so:

Detecting if a UDP denial of Service is targeting the server
The following command lists information about possible UDP DoS

You could also check for both UDP and TCP DoS like so:

Detecting an SYN flood with netstat

It is quite high to have 1032 SYNs per second except when the server is not serving about 6000 user requests per second. 1032 is high and suggests a possibility the server is under attack.
Two other netstat commands with the same application are:

And

You might want to channel an IP that has set up an excess of associations with the server since it may be the host to Dos. You use /sbin/route command to carry out the filter.
Here is how to null route the admission of IP 110.92.0.55:

If you want to look later at a routed nulled IP to host, use:

Ways to mitigating DoS attack in Apache
1. Mitigating a slow HTTP DoS Attack in Apache HTTP Server. There are techniques to mitigate this attack using mod_reqtimeout, mod_qos, and mod_security. All these require different configurations but ambiguously reduce slow HTTP.
2. MaxClients order chooses the quantity of solicitations Apache serves. It is 256 as a matter of course and any association endeavor over this breaking point is lined up to a figure taking into account the ListenBacklog order; its default is regularly 511. One can keep a TCP SYN surge assault by expanding these qualities.
3. Utilizing movement forming modules: This is a method that manufactures control over Web server activity. Most Apache modules execute movement molding to control the data transfer capacity utilization on the per-virtual-host level, or to back off a (customer) IP address (Gupta et.al, 2012). A DDos assault can likewise be forestalled all the while. Illustrations of these modules include:
a. mod_limitipconn cutoff points download allowed from a solitary IP address.
b. mod_throttle lessens the heap on your server, and the information exchange yielded by well-known virtual hosts, areas, registries, or clients.
c. mod_bwshare uses past downloads by a client IP address to accept or rejects HTTP requests from that client IP address.
4. Usage of the third party software. The software has been developed to help palliate DoS attacks in Apache. Cases of these delicate products are Incasula, CloudFlare and ConfigServer Security and Firewall (CSF) that offer administrations to ensure and quicken sites online (Unrein et.al, 2012).
5. Using mod_evasive for Apache
The mode_evasive Apache module, earlier called mod_dosevasive, helps prevent Dos, DDoS, and brute force on an Apache server. The module provides evasive actions during an attack and reports the cases of abuse via emails and Syslog facilities. It does this by creating an active internalactive table of IPs and URLS and also denies any IP address from:
• Requesting similar single pages more than a couple of times per second.
• Requesting while they are temporarily blacklisted.
• Requesting for more than fifty consistent solicitations for every second on the same kid.
A 403 reaction is sent at whatever point one of the said conditions is met furthermore, the IP location is logged. Alternatively, the IP address can be blocked by running system commands, or email notification may be sent to the server’s owner (Gupta et.al, 2012).
Before using the mod_evasive module, a configuration of your Linux system must first be done.
Implementation of using mod_evasive on Apache
Prerequisites.
h we will be using) or CentOS 6 Droplet.

Step 1- Installation of mod_evasive
Firstly, Extra Packages for Enterprise Linux (EPEL) yum store should be introduced to server. EPEL is a Federa Special Interest Group whose work is to make, keep up, and handle great open sources add-on programming bundles for Linux.
Issue this command for the installation and enabling the EPEL repository:

Use the following command to verify EPEL repo is enabled:

If enabled, the following repo will be listed:

We then bring in yum plugin protect – base to protect base packages from EPEL

Protect – base plugin protects certain yum repositories against updates from other repositories. Installation of mod_evasive is the next step.
Issue this order to introduce it:

Step2- Verification of the Installation
The file /etc/httpd/conf.d/mod_evasive.conf, for configuration was added during the previous installation. To confirm this run:

The output should resemble this:
-rw-r–r– 1 root root 3473 Nov 30 01:41/etc/httpd/conf.d/mod_evasive.conf
The accompanying LoadModule line is put at the highest point of design record mod_evasive.conf. Apache web server loads and uses the mod_evasive module due to this line. In case the line is not present, open the configuration file and manually add the line.

Listing modules loaded on Apache and looking for mod_evasive:

The following should be the output:

Step 3- Configuration of mod_evasive
The mod_evasive.conf file can be used to customize easily mod_evasive. Configuration options that need to be changed include:
DOSEmailNotify.The importance of this directive is that when set, it sends an email to the specified email address whenever the blocking of an IP occurs. The following is an example of what the email body will look like:
 mod_evasive ip HTTP Blacklisted  address 111.111.111.111
To edit an email address to which mod_evasive alerts are sent, you edit the file using these command:

At that point uncomment on the DOSEmailNotify line by first erasing the # sign before the line, and afterward, change the email location to yours, suppose [email protected]
A mail server should be introduced and is working following/receptacle/mail is utilized to send email alarms by mod_evasive.
DOSWhitelist. This option is used to add IP addresses of only trusted clients to the whitelist guarantee their access. Whitelisting ensures programming, nearby hunt bots, scripts, and some robotized devices from them being refused for asking for a lot of information from the server.
Add an entry like this so as to whitelist an IP address. For instance IP address 111.111.111.111

You can also whitelist more than one IP addresses from various IP ranges by adding separate DOSWhitelist lines like this:

Other two parameters that need changing to a lesser value to reduce chances of clients getting blocked unnecessarily are:
C. DOSPageCount which is the limit for an IP address to the requests for similar pages per page second. The IP of a client is added to the blacklist once it exceeds the brink for that interval. 2 is the default value and is quite low. One can revert it to a bigger value, say 20, as below:
d. DOSSiteCount that is the breaking point on the quantity of solicitations on the same site by an IP address for each site interim (typically set to one second). One can transform it to a more prominent quality like a hundred seconds like so:

There are different parameters you can adjust to accomplish better execution. Among them being DOSBlockingPeriod that is the measure of time an IP location is denied access for once they get added to the boycott.
Step 4 – load the mod_evasive Module
A restart of the Apache web server is required once the progressions have been made in the setup record.
Issue this order to restart Apache.
mod_evasive may conflict with existing FrontPage Server Extensions. A check on the Apache server settings is therefore required so as to make certain mod_evasive is functioning
Step 5 – A test on mod_evasive
We shall use a perl script test.pl written by the developers of mod_evasive to test mod_evasion. An install of perl package on the server is first needed. To install perl, run:

The test script is presented with mod_evasive in this area:

The test script as a matter of course demands the same page100 times in succession from the Apache web server to trigger mod_evasive. Beforehand, we changed mod_evasive to be quicker of solicitations to the same page every second. We in this way ought to change the script to two hundred in rather than one hundred solicitations in succession to make certain we trigger all of notice strategies for mod_evasive.
Issue: and look for the line, and replace 100 with 200, then save and exit.
To start the script, run:

An output similar to this should be produced:

The 403 response code shows the web server denies access after the script has made 100 requests to the web server. Concurrently, once the IP is blocked, mod_evasive logs to syslog. You can check using this command the log file:

A line like this should be shown:
Nov 30 00:11:18 server name mod_evasive[18290]: Blacklisting address 127.0.0.1: possible DoS attack.
Pointing mod_evasive has blocked the IP address.
An email with the accompanying substance is sent that is if mod_evasion has been designed to send email cautions when an IP is blocked.

Conclusions
It is a very good idea to consider integrating mod_evasive module since it is great at obviating scripted, single server and not forgetting distributed attacks. In any case, it is just valuable to the point of the server’s aggregate data transmission and a processor’s ability to process and react to invalid solicitations. One can mitigate an attack according to what they are facing like for example using mod_reqtimeout, mod_qos, and mod_security to mitigate slow http attacks. A heavy DoS might still take you offline if you lack a good infrastructure and firewall in place. A hardware based mitigation solution can finally be considered if an attack persists.
References:
Zargar, S. T., Joshi, J., & Tipper, D. (2013). A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks. Communications Surveys & Tutorials, IEEE, 15(4), 2046-2069.
Gupta, B. B., Joshi, R. C., & Misra, M. (2012). Distributed Denial of Service prevention techniques. arXiv preprint arXiv:1208.3557.
Unrein, E., Fish, D., Boeker, J., & Sun, W. (2012). Living in Denial-A Comparison of Distributed Denial of Service Mitigation Methods. Issues in Information Systems, 13(1), 190-198.
Duravkin, I., Loktionova, A., & Carlsson, A. (2014, October). Method of slow-attack detection. In Infocommunications Science and Technology, 2014 First International Scientific-Practical Conference Problems of (pp. 171-172). IEEE.