Issue DDoS attack on ip address

[Linulex]

Server operating system version

alma 8.10

Plesk version and microupdate number

18.0.80 Update #6

We have a server that is undergoing a DDoS attack on its ip address. Not a website (that can be solved by Cloudflare), but they connect to the servers ip address.

At the moment i have solved this by adding

return 444;

to the various server blocks in

/etc/nginx/plesk.conf.d/server.conf.

But this file gets overwriten by plesk. Is there a permanent way to add this somewhere? Lets say a kind of vhost.conf for the server default or something like that.

thank you
regards
Jan

 

[Linulex]

Apparently this wasn't the solution. The log file grew to 156GB in 3 hours.

Is there anyone that knows a solution on how to stop this ddos attack?

ideal would be to return 444, but without logging it. I have not found how to do this.

Regards
Jan

 

[Azurel]

Which log file grew to 156 GB? Please provide the full path and filename.

You can check which IP addresses generated the most requests during the last two hours. For example, for domain access logs:

awk -vDate="$(date -d '2 hours ago' '+[%d/%b/%Y:%H:%M:%S')" '$4 > Date {print $1}' /var/www/vhosts/system/*/logs/access_ssl_log | sort | uniq -c | sort -nr | head

You can also check which remote IP addresses currently have the most connections to the server:

netstat -natu | awk 'NR>2 {print $5}' | sed 's/:[^:]*$//' | sort | uniq -c | sort -nr | head

Another useful check is to look for unusually frequent User-Agent strings:

awk -F" '{print $6}' /var/www/vhosts/system/*/logs/access_ssl_log | sort | uniq -c | sort -nr | head

These checks can help identify suspicious traffic patterns, such as a small number of IP addresses generating a very large number of requests or many requests using the same User-Agent.

 

[Linulex]

/var/log/nginx/access.log

It logs every 444 entry.

and offcourse every connection from the ddos attack.

Regards
Jan

 

[Azurel]

The information you’ve provided is quite limited. Have you checked which URLs are being requested in the log?
For example, have you looked at the latest 50 entries?:

# tail -n 50 /var/log/nginx/access.log

Have you also checked where the source IP addresses originate and whether certain IPs account for a large number of requests? Plesk Firewall Extension can block countries.

 

[Kaspar]

Blocking traffic based on the suggestions for @Azurel is a great start. Depending on the severity of the DDoS , you might want to conder configuring an additional IP to divert regular traffic to it and block port 80/443 traffic on the current IP.

It might also be worth to check if traffic actually directed at the servers IP address or is perhaps directed at a domain no longer present on the server (but for which there are still DNS records pointing to the server). If it's the latter case, you could block all of the traffic for that specific host. The tcpdump utility can help you inspect network traffic (it's not installed on Almalinux by default, so you'll like have to install it first).

timeout 60 tcpdump -i any -nn -s 0 -A 'tcp dst port 80' 2>/dev/null \
    | grep -i '^Host:'

If the ddos is in fact direct at a domain, you use iptables to block traffic for that domain (only works for traffic on port 80).

iptables -A INPUT -p tcp --dport 80 -m string --string "example.com" --algo bm -j DROP

 

[Linulex]

I don't think the information was limited. It is as i stated in the title: the attack is/was on the ip address, not a domain. If it was on a domain it could be easy solved by cloudflare. But cloudflare doesn't do ip addresses.

Whenever there are more then 1000 connections open nginx and apache are restarted and a dump is taken. The dumps are always full of connections to

default-185-95-xx-xxx:7081

1000 connections from almost a 1000 different ip addresses.

I have looked at the last 10.000 entries in the log file and its always the same. We have a normal

limit_conn antiddos 75;

entry to counter dos attacks, but the very nature of ddos is that they originate from all different ip addresses.

I have solved it for now by adding

access_log off;
return 444;

to the listen ip address parts of

/etc/nginx/plesk.conf.d/server.conf

The server isn't reachable on ip address anymore, but who cares?

Thanks for all your input and help.

regards
Jan