APF + BFD + DDOS + Rootkit

NP there, but if you reboot wont it just start the firewall again?.
Maybe a pre cofig for the ports that need to be open.....
Perhaps the author will shed some input. :)
 
AndyII said:
NP there, but if you reboot wont it just start the firewall again?.
Maybe a pre cofig for the ports that need to be open.....
Perhaps the author will shed some input. :)
Click to expand...

If you run kiss from the command line, it won't start automatically after reboot. In order to start it automatically, you have to put it into /etc/rc.d/init.d/ and enable for required runlevels with chkconfig.
 
thanks for your help, did PM author but looking to do this right and with production server, cant afford any "oops"..
I think I have un comment this line as Im running centOS 4.x
#EXTN="o"
 
on the kiss install, all goes well but at this command it doesn't work
chown root:root
Code: 
 chown root:root
chown: too few arguements
 
AndyII said:
on the kiss install, all goes well but at this command it doesn't work
chown root:root
Code: 
 chown root:root
chown: too few arguements
Click to expand...

I am not sure what install script you are talking about, but chown command expects 2 arguments: user name (optionally followed by semicolon and groupname) and the file name.
It looks like the 2nd argument is missing in your install script.
 
this is the KISS firewall listed here, so what you are saying is the command didnt include the file name?, instructions were as:
cd /usr/bin/
wget http://www.web4host.net/tools/kiss
chmod 700 kiss
chown root:root

should it have been?
chown root:root kiss

Originally Posted by @how@ View Post
Kiss Version 2.0 ready to use in CentOS 4
cd /usr/bin/
wget http://www.web4host.net/tools/kiss
chmod 700 kiss
chown root:root

That's it! To get it running anywhere on the command line, you simply type:
kiss start
To stop the firewall, type:
kiss stop
To get status information, type:
kiss status
If you want to block an offenders IP address/subnet, simply edit the BLOCK_LIST variable in the /usr/bin/kiss file. You can separate IP addresses and subnet's with a space. Once you are finished, simply restart KISS by typing:
kiss restart

here you can fine Version 2.1
http://www.geocities.com/steve93138/


Wael
Click to expand...
 
Last edited:
thank you Webcart.
just curious, if this file wasn't changed for ownership, what is the wost that could happen? could the firewall be compromised?
 
AndyII said:
thank you Webcart.
just curious, if this file wasn't changed for ownership, what is the wost that could happen? could the firewall be compromised?
Click to expand...

It depends on what userid you were running wget command under.
As you are supposed to run this as root anyway, nothing would happend most probably, it's just a matter of good practice to set permissions and ownership explicitly.
 
Last edited:
Thanks to all for the help, one of the many reasons I prefer DA over the others... :)
there are no "logs" to this, are there? nice to be able to see what work it is doing....
 
AndyII said:
Thanks to all for the help, one of the many reasons I prefer DA over the others... :)
there are no "logs" to this, are there? nice to be able to see what work it is doing....
Click to expand...

I believe by default it will log martians addresses, you can add more log rules as you find appropriate. Not sure what you mean by "to be able to see what work it is doing", though. Type
Code: 
iptables -L
to see the firewall rules.
 
urgent

urgent, anyone know How do we limit the http connections per IP, or a way to stop flooding?
perhaps KISS doesn't have this capability?, Please point me in the correct path, please?.....
Andy

@how@ said:
Kiss Version 2.0 ready to use in CentOS 4
cd /usr/bin/
wget http://www.web4host.net/tools/kiss
chmod 700 kiss
chown root:root

That's it! To get it running anywhere on the command line, you simply type:
kiss start
To stop the firewall, type:
kiss stop
To get status information, type:
kiss status
If you want to block an offenders IP address/subnet, simply edit the BLOCK_LIST variable in the /usr/bin/kiss file. You can separate IP addresses and subnet's with a space. Once you are finished, simply restart KISS by typing:
kiss restart

here you can fine Version 2.1
http://www.geocities.com/steve93138/


Wael
Click to expand...
 
smtalk said:
mod_limitipconn :)
Click to expand...

ok, thanks, can you elaborate on how to use?, searching Google seems to point to ftp, Im not using Apache 2.
where is this invoked?, in the http config....
any help is appreciated :)
 
One quick question. When I set sshd so root can't login, it works fine. But when I use my user login and su and try to type apf, bfd, ddos it says "bash: command not found". Is that suppose to happen. Do I have to actually ssh in as root. I disabled that for a reason?

Thanks
 
No, you don't have to log in as root.

But when you log in as admin and/or some other username, you've got your paths and settings for your username, not for root. When you use su you still have your paths and settings, so you don't know where anything usable only by root is found.

Instead of su use su - (note the space and then the - character)

Then you'll have a new root login and everything will work.

Jeff
 
The config file is in /usr/local/ddos/ddos.conf , set your max connections, alert and such in there.

The usage is pretty self explanatory

Usage: ddos.sh [OPTIONS] [N]
N : number of tcp/udp connections (default 150)
OPTIONS:
-h | --help: Show this help screen
-c | --cron: Create cron job to run this script regularly (default 1 mins)
-k | --kill: Block the offending ip making more than N connections
Click to expand...
can someone explain the tcp/udp connections, default is set at 150, is this a normal high?, how much can you tighten this without going to low....
 
AndyII said:
can someone explain the tcp/udp connections, default is set at 150, is this a normal high?, how much can you tighten this without going to low....
Click to expand...

How does a server get it's own IP banned?????
email message
Banned the following ip addresses on Fri Sep 21 14:47:01 EDT 2007

xxx.xxx.xx.xx with 1644 connections
Click to expand...
 
You must log in or register to reply here.
Back
Top