DDoS / Layer 7 Firewall mit Proxy?

Rund um die Sicherheit des Systems und die Applikationen
Post Reply
chris.berlin
Posts: 6
Joined: 2005-04-22 16:11
 

DDoS / Layer 7 Firewall mit Proxy?

Post by chris.berlin »

N'abend,

auf einem meiner Server habe ich mal wieder einen recht ekelhaften DDoS Angriff.

Hier ein kurzer Auszug aus den Logs:

Code: Select all

85.54.36.13 - - [12/Jun/2009:16:35:55 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "www.smsgott.de"
89.38.197.189 - - [12/Jun/2009:16:35:38 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
91.8.98.165 - - [12/Jun/2009:16:36:02 +0200] "GET /upload/avatars/thumbs/zbbbgxhcxmrcnzqmctlgr8lpu6winljj.jpg HTTP/1.1" 200 6912 "http://www.smsgott.de/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10" "www.smsgott.de"
85.85.33.79 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)" "www.smsgott.de"
79.113.128.192 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
88.234.90.5 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)" "www.smsgott.de"
202.63.112.24 - - [12/Jun/2009:16:35:59 +0200] "GET / HTTP/1.0" 500 443 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)" "www.smsgott.de"
91.8.98.165 - - [12/Jun/2009:16:36:03 +0200] "GET /upload/avatars/thumbs/egopnfve9ccro2cksxijtgfssjqdc8oo.jpg HTTP/1.1" 200 7510 "http://www.smsgott.de/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10" "www.smsgott.de"
92.83.44.76 - - [12/Jun/2009:16:36:03 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
213.158.196.118 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)" "www.smsgott.de"
94.50.64.233 - - [12/Jun/2009:16:36:03 +0200] "GET / HTTP/1.0" 500 385 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; MRA 5.4 (build 02647); MRSPUTNIK 2, 0, 1, 90 SW; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
92.85.135.168 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 385 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6)" "www.smsgott.de"
92.252.145.147 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 385 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
189.13.112.71 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
87.126.97.233 - - [12/Jun/2009:16:36:03 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" "www.smsgott.de"
194.225.17.200 - - [12/Jun/2009:16:35:57 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2; .NET CLR 2.0.50727)" "www.smsgott.de"
190.226.6.168 - - [12/Jun/2009:16:35:58 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727)" "www.smsgott.de"
89.40.57.163 - - [12/Jun/2009:16:36:03 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
190.255.1.131 - - [12/Jun/2009:16:36:03 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)" "www.smsgott.de"
89.38.197.189 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
58.8.46.151 - - [12/Jun/2009:16:36:02 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6)" "www.smsgott.de"
Server ist ein Quad bei hosteurope: http://www.hosteurope.de/produkt/WebPack-Pro-MAX2 - also schon ne ordentliche Maschine.

Hosteurope arbeitet an der Lösung, versucht Firewall regeln anzupassen usw usf.... Meiner Erfahrung nach (gleicher Angriff auf anderer Domain bei domainfactory) wird das ohne Erfolge bleiben. Der domainfactory Server läuft zwar wieder, allerdings durch Schutz über einen transparenten Proxy mit Firewall bei dragonara.net.

Nun würde ich gern selbst den bösen Traffic ausfiltern und den sauberen zu hosteurope weiterleiten. Da ich bei hosteurope keine Applikationen instlalieren kann, ist mein Plan:
- Root Server irgendwo holen
- Dort installiere ich eine Layer-7 Firewall in Kombination mit einem transparenten Proxy
- Server leitet den Traffic gefiltert zu hosteurope weiter

Nun meine Fragen:
- Gibt es bzw kennt ihr eine solche Firewall die effektiv den Traffic filtern kann?
- Hat jemand von euch Erfahrungen mit Layer 7 Firewalls?

Gefunden habe ich lediglich Zorp: http://www.balabit.com/network-security ... teway/gpl/ - allerdings noch nicht ausprobiert. Zorp gibts zwar auch als GPL Version, im Grunde ist mir jedoch egal was die Firewall kosten wird. Hauptsache der Misttraffic ist weg :(

Danke für eure Hilfe!!

Grüße
Chris
Top
User avatar
daemotron
Administrator
Administrator
Posts: 2641
Joined: 2004-01-21 17:44
Contact:
Contact daemotron
 

Re: DDoS / Layer 7 Firewall mit Proxy?

Post by daemotron »

Wenn Du keine Appliance einsetzen kannst, fällt mir außer Zorp auch bloß Apache + mod_proxy + mod_evasive bzw. mod_security ein - allerdings wird ein solches Setup einem DDoS auch nur marginal besser standhalten als der blanke Webserver. HAProxy wäre vielleicht auch noch eine Möglichkeit, hier sind die Filtermöglichkeiten aber eher rudimentär. Ein selbstgebastelter Reverse Proxy wird unter einem richtigen DDoS aber ebenso zusammenbrechen und nicht mehr in der Lage sein, die "guten" Requests noch an sein Backend durchzustellen...

Spannend für dich wäre eventuell noch eine Layer deescalation - also Clients, die einmal (n-mal) auf Layer 7 negativ aufgefallen sind, schon auf Layer 3 abzufangen. Allerdings birgt das auch ordentliche Risiken (Stichwort: Proxy), aber im Falle eines laufenden DDoS wäre es vielleicht ein probates Mittel, den Dienst zumindest einigermaßen aufrecht erhalten zu können.
“Some humans would do anything to see if it was possible to do it. If you put a large switch in some cave somewhere, with a sign on it saying 'End-of-the-World Switch. PLEASE DO NOT TOUCH', the paint wouldn't even have time to dry.” — Terry Pratchett, Thief of Time
Top
User avatar
Joe User
Project Manager
Project Manager
Posts: 11191
Joined: 2003-02-27 01:00
Location: Hamburg
Contact:
Contact Joe User
 

Re: DDoS / Layer 7 Firewall mit Proxy?

Post by Joe User »

Das ist kein DDoS, das ist stinknormales Grundrauschen...
PayPal.Me/JoeUser ● FreeBSD Remote Installation
Wings for Life ● Wings for Life World Run

„If there’s more than one possible outcome of a job or task, and one
of those outcomes will result in disaster or an undesirable consequence,
then somebody will do it that way.“ -- Edward Aloysius Murphy Jr.
Top
chris.berlin
Posts: 6
Joined: 2005-04-22 16:11
 

Re: DDoS / Layer 7 Firewall mit Proxy?

Post by chris.berlin »

Danke für die schnelle Antwort. Was genau meinst du mit Appliance?

Ich weiß nicht ob ich das mit der layer deescalation richtig verstanden habe. Hosteurope sperrt derzeit wohl per iptables massenweise IPs anhand der Logs aus. Bisher ohne merkbare Besserung.

@Joe: Hier mal ein längerer Logauszug (100 Zeilen). Darunter finde ich keinen normalen Zugriff. Und das ist nicht mal eine Sekunde des Logs...

Code: Select all

91.18.247.8 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 301 541 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10" "smsgott.de"
77.31.248.53 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
213.164.249.6 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; SIMBAR={C8168FB6-D3CD-4C93-89BD-17D53231EA4A})" "www.smsgott.de"
89.130.67.28 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
92.80.38.237 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6)" "www.smsgott.de"
79.175.88.137 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
89.122.2.5 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6)" "www.smsgott.de"
195.189.65.114 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
77.31.248.53 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
77.31.248.53 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
77.31.248.53 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
190.234.95.160 - - [12/Jun/2009:17:37:04 +0200] "GET / HTTP/1.0" 200 19600 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
86.126.93.191 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
92.54.248.88 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
189.157.254.225 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "www.smsgott.de"
213.158.196.118 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)" "www.smsgott.de"
89.137.209.235 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB5)" "www.smsgott.de"
78.37.159.227 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" "www.smsgott.de"
86.121.240.21 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" "www.smsgott.de"
87.16.18.194 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)" "www.smsgott.de"
83.221.195.187 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRSPUTNIK 2, 0, 1, 55 SW; .NET CLR 2.0.50727)" "www.smsgott.de"
94.101.128.42 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.2)" "www.smsgott.de"
92.83.164.247 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; SIMBAR={B22ADFD4-EF9C-4661-9ABF-6C89D32C09F3})" "www.smsgott.de"
77.123.212.186 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727)" "www.smsgott.de"
86.57.228.13 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
90.150.202.77 - - [12/Jun/2009:17:37:00 +0200] "GET / HTTP/1.0" 500 385 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; MRA 5.4 (build 02647); MRSPUTNIK 2, 0, 1, 90 SW; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
82.51.52.235 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)" "www.smsgott.de"
79.39.34.95 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
79.119.203.94 - - [12/Jun/2009:17:37:00 +0200] "GET / HTTP/1.1" 500 371 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)" "www.smsgott.de"
200.1.28.87 - - [12/Jun/2009:17:37:01 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
77.81.153.192 - - [12/Jun/2009:17:36:45 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
89.123.53.24 - - [12/Jun/2009:17:37:01 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DS_desktopsmiley; SIMBAR={AB3E25FF-8719-4BF6-B254-38E1446A99FC})" "www.smsgott.de"
92.54.209.67 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "www.smsgott.de"
89.46.144.152 - - [12/Jun/2009:17:36:54 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
86.121.240.21 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" "www.smsgott.de"
87.126.97.233 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" "www.smsgott.de"
195.238.107.43 - - [12/Jun/2009:17:36:57 +0200] "GET / HTTP/1.0" 200 16060 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.1)" "www.smsgott.de"
92.84.40.94 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
85.204.133.98 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6)" "www.smsgott.de"
86.121.240.21 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" "www.smsgott.de"
87.221.119.218 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727)" "www.smsgott.de"
89.123.35.230 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
89.130.67.28 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
89.46.144.152 - - [12/Jun/2009:17:36:55 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
89.232.124.209 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 5.3 (build 02552); MRSPUTNIK 2, 0, 1, 54 SW)" "www.smsgott.de"
195.238.107.43 - - [12/Jun/2009:17:36:58 +0200] "GET / HTTP/1.0" 500 385 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.1)" "www.smsgott.de"
77.81.153.192 - - [12/Jun/2009:17:36:43 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
77.81.153.192 - - [12/Jun/2009:17:36:33 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
190.229.175.130 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)" "www.smsgott.de"
77.40.88.18 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)" "www.smsgott.de"
125.27.198.78 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
92.84.40.94 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
91.205.168.108 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
87.16.18.194 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)" "www.smsgott.de"
77.81.153.192 - - [12/Jun/2009:17:36:54 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
92.101.182.26 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1; .NET CLR 2.0.50727)" "www.smsgott.de"
72.38.3.61 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "www.smsgott.de"
87.126.97.233 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" "www.smsgott.de"
89.123.63.196 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727)" "www.smsgott.de"
86.126.93.191 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
79.117.159.150 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)" "www.smsgott.de"
92.84.40.94 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
91.205.183.127 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WebMoney Advisor; MRA 5.1 (build 02214); MRSPUTNIK 2, 0, 0, 36 SW; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
92.80.192.185 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
77.81.153.192 - - [12/Jun/2009:17:36:33 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
89.232.124.209 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 5.3 (build 02552); MRSPUTNIK 2, 0, 1, 54 SW)" "www.smsgott.de"
79.117.159.150 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)" "www.smsgott.de"
79.117.159.150 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)" "www.smsgott.de"
86.57.228.13 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 500 320 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
77.81.153.192 - - [12/Jun/2009:17:36:33 +0200] "GET / HTTP/1.0" 500 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
78.97.190.32 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; DS_desktopsmiley; desktopsmiley_2_1_261979311139932_738_7)" "www.smsgott.de"
89.123.35.230 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
92.81.250.128 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
89.123.53.24 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DS_desktopsmiley; SIMBAR={AB3E25FF-8719-4BF6-B254-38E1446A99FC})" "www.smsgott.de"
86.126.93.191 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
78.96.82.202 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)" "www.smsgott.de"
201.18.142.130 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)" "www.smsgott.de"
79.116.120.114 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
79.119.203.94 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 500 371 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)" "www.smsgott.de"
89.37.213.115 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "www.smsgott.de"
87.221.119.218 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727)" "www.smsgott.de"
92.81.186.3 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts)" "www.smsgott.de"
79.116.120.114 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
190.40.75.26 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
92.85.175.200 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)" "www.smsgott.de"
190.49.15.243 - - [12/Jun/2009:17:36:47 +0200] "GET / HTTP/1.1" 200 20440 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; uE v7)" "www.smsgott.de"
83.8.63.89 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
89.235.208.249 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6; InfoPath.2)" "www.smsgott.de"
89.37.213.115 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "www.smsgott.de"
89.123.63.196 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6; .NET CLR 2.0.50727)" "www.smsgott.de"
79.117.159.150 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)" "www.smsgott.de"
79.116.36.177 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1)" "www.smsgott.de"
79.117.159.150 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)" "www.smsgott.de"
89.114.238.145 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
87.224.189.234 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
69.215.45.113 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2)" "www.smsgott.de"
78.30.209.75 - - [12/Jun/2009:17:37:04 +0200] "GET / HTTP/1.0" 200 22239 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; WebMoney Advisor; MRA 5.4 (build 02606); .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)" "www.smsgott.de"
79.117.159.150 - - [12/Jun/2009:17:37:03 +0200] "GET / HTTP/1.0" 200 22255 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)" "www.smsgott.de"
79.116.120.114 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.0" 503 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
88.213.56.178 - - [12/Jun/2009:17:37:05 +0200] "GET / HTTP/1.1" 503 722 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "www.smsgott.de"
Top
User avatar
daemotron
Administrator
Administrator
Posts: 2641
Joined: 2004-01-21 17:44
Contact:
Contact daemotron
 

Re: DDoS / Layer 7 Firewall mit Proxy?

Post by daemotron »

chris.berlin wrote:Danke für die schnelle Antwort. Was genau meinst du mit Appliance?
Appliance = dediziertes Gerät, das für einen bestimmten Zweck mit Software vor-ausgerüstet ist. Es gibt gerade im Firewall-Sektor einiges, was da angeboten wird. Dummerweise hast Du bei HostEurope keine dedizierte Maschine, sondern ein Shared Hosting Angebot (und mal abgesehen davon glaube ich auch nicht, dass irgendein Provider artfremde Hardware in sein Netzwerk integrieren würde...)
chris.berlin wrote:Ich weiß nicht ob ich das mit der layer deescalation richtig verstanden habe. Hosteurope sperrt derzeit wohl per iptables massenweise IPs anhand der Logs aus. Bisher ohne merkbare Besserung.
HostEurope sperrt die IPs wahrscheinlich nicht per iptables, sondern direkt an ihren Routern (die setzen Cisco und Juniper Geräte ein - was sie vor den Shared Hosting Kisten haben, weiß ich allerdings nicht). Das Problem dabei: bei einem DDoS sind viele verschiedene IPs im Spiel. Manuelles Sperren ist zu langsam, und wenn Dial-Up-Kisten beteiligt sind, kommt man einfach überhaupt nicht hinterher mit sperren.

Layer deescalation bezog sich auf Deine Überlegung, einen Layer-7-Filter einzusetzen. Wenn Du auf Layer 7 filterst, ist das fast so teuer wie die Beantwortung eines Requests (es sei denn, Du hast eine dynamische Anwendung am laufen, die erst die Frage zu "42" berechnet, bevor sie antwortet). Wenn von einer IP aus mehrfach zugegriffen wird (mit grep '<ip>' <logfile> | wc -l kannst Du das feststellen), lohnt es sich ggf., nach der zwanzigsten oder dreißigsten Anfrage (hängt von Deiner Website ab, wie viele Bilder drauf sind etc.) innerhalb eines sehr kurzen Zeitraums Verbindungsversuche von dieser Source IP bereits auf Layer 3 abzublocken. Das hilft aber auch nur bedingt. Wenn genügend Clients am DDoS beteiligt sind, kriegen die den Network Stack auf Layer 3 auch irgendwann klein; außerdem kann es Seiteneffekte geben (wenn ein DDoSer über einen Proxy kommt, werden alle User hinter dem Proxy geblockt, etc).

Gegen einen richtigen DDoS kann man i.d.R. nicht viel machen. Mögliche Gegenmaßnahmen sind extrem aufwändig (da braucht's ein Gesamtpaket aus viel Bandbreite, Loadbalancern, mehreren Backends, Traffic Shaping), weil es eine Art Wettrüsten mit dem Angreifer ist. Selbst großen Firmen bleibt manchmal nichts anderes übrig, als einen Dienst eben vorübergehend vom Netz zu nehmen, die IP zu wechseln oder DNS-Einträge vorübergehend auf eine Teergrube zu jagen.
“Some humans would do anything to see if it was possible to do it. If you put a large switch in some cave somewhere, with a sign on it saying 'End-of-the-World Switch. PLEASE DO NOT TOUCH', the paint wouldn't even have time to dry.” — Terry Pratchett, Thief of Time
Top
Post Reply

Return to “Security”