Protection from DOS and SYN flood attacks Print

  • 0

To protect your server and forum from these, open the CSF configuration file like so,
Code:
cd /etc/csf
pico csf.conf

Use CTRL + W to find the following, (one at a time)
and adjust their values to look like this
Code:
CT_LIMIT = "50"
CT_SKIP_TIME_WAIT = "1"
SYNFLOOD = "1"

Now you are protected from DOS and SYN flood attacks, and will be notified by email when an IP is blocked.

Protection from spam attacks

You can configure CSF to block known spammers in the Dshield, Spamhaus and BOGON lists, to do this, open the CSF configuration file again,
Code:
cd /etc/csf
pico csf.conf
FASTSTART="1"

Use CTRL + W to find the following, (one at a time)
and adjust their values to look like this,
LF_DSHIELD = "86400"
LF_SPAMHAUS = "86400"
LF_BOGON = "86400"

BOGON is optional, I don't recommend it as much.
Now your server and forum is protected from a huge list of known bad IP's, ever growing.
----------

Other useful settings

You can block countries known to attack, find the following,
Code:
CC_DENY = ""

and modify it to suit your needs, so if you want to block all incoming traffic from Great Britain and China, adjust it like this,
Code:
CC_DENY = "RU,DE,CN,CL,CO,HR,CZ,KP,DO,DM,IN,ID,IR,IQ,KZ,LR,LY,NG,NO,PK,PY.PE,KR,RO,WS,SM,ST,SN,RS,SK,SI,SO,SS,SE,LK,SD,SR,SY,TJ,TH,MK,TL,TG,TO,TT,TR,TM,TV,UG,UA,AE,TZ,UY,UZ,VU,VN,YE,ZM"
CC_ALLOW = "ZA"
----------

You can configure lfd to watch directories for suspicious files, find the following,
Code:
LF_DIRWATCH

and give it a value of 300,
Code:
LF_DIRWATCH = "300"

If a suspicious file is found, you will receive an email.

Was this answer helpful?

« Back