On 13 Mar 2024 20:20 +0100, from jfbache...@free.fr (Jean-François Bachelet): > Looking for advice for protecting debian servers from DoS attacks
Denial of service (such as software crashes because of network input), or distributed denial of service (such as connection or system overload because of excessive traffic)? A good start for the former would be to have an easy way to monitor for and apply software updates quickly throughout your stack. The latter is almost impossible to defend against once the traffic has reached the host in question; however, many service providers offer DDoS protection *before* the traffic even reaches the server or maybe even the network, which allows soaking up much greater traffic volumes. So, just for clarity's sake: which is it? > needless to say that fail2ban isn't enough for this task... > > scripts for firewall too... and tiring to make as hackers responses are > damn' fast to this. I could be wrong, but to me this suggests a wrong approach to firewalling. You should run a default-drop or default-reject firewall, and only allow the traffic that is explicitly needed to provide the service that the particular host is supposed to offer. Then there should be very little need to continuously adapt to attackers' tactics on the network level. > what solutions (free or not) do you debian servers pros use (for pro or > private servers) ? Crowdsec is supposed to be quite good; used in a typical fashion, it's similar to fail2ban, but leverages data on attacks from a large number of systems. I understand it can be run either locally on your network or distributing attack data over the Internet also to other users (and benefit from those users' data as well). Another thing that might help for non-public services but certainly isn't a panacea is port knocking and running services on non-standard ports. I use both myself mostly to cut down on log noise, but it's not something that most non-technical users can be expected to be able to deal with; and of course to someone on the network path, it should be considered essentially plaintext authentication. Still, it does reduce the impact of background noise scanning. And of course, again, having a plan and process to apply updates (especially but not necessarily restricted to security-related updates) quickly as they become available. -- Michael Kjörling 🔗 https://michael.kjorling.se “Remember when, on the Internet, nobody cared that you were a dog?”