AWS Monster | Your Technical Partner

There is no practical way to actually prevent Dos / DDoS attacks, because your server is connected to the internet. When you are connected to the internet, even with a simple local PC computer you are exposed to remote attacks. The only thing you can do is to mittigate its effects. When you are under ddos and trying to mitigate the attack, the server will not respond normally, it will get slower than usual, it can often appear down temporary while the attack is decreasing. On large-volume attacks your provider can even null-route the server IP address to avoid from overload their entire network. Can CSF firewall help me to stop only small / medium attacks? Why not large attacks? Beacuse of the way DDOS works. For very large and distributed attacks, you must use a dedicated firewall, or an specialized antiddos shield that works on network level inside the datacenter where you are hosted, or you can use 3rd party anti-ddos services like Cloudflare, Incapsula or Level3 AntiDDOS servi...

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are common threats that every publicly accessible web server faces. The purpose of such attacks, in simplest terms, is to flood a server with connections, overloading it and preventing from accepting legitimate traffic. Step #1: SYNflood Protection A SYNflood attack is a DoS attack exploiting the TCP (Transmission Control Protocol) connection process itself. In basic terms, a TCP connection is established using a three-way handshake: The client (incoming connection) sends a synchronization packet (SYN) to the server. The server responds with a synchronization acknowledgement (SYN/ACK) to the client. The client then responds with an acknowledgement (ACK) back to the server. A SYNflood attack manipulates that three-way handshake by initiating multiple synchronization requests and then refusing to respond with any final acknowledgements. On a Linux server, you can quickly check for SYN packets by running thi...

Restricting access by port to IP addresses originating in a specific country or countries can be an effective way to help minimize the negative performance impact that country-level blocking can bring. In this example , we’re blocking access to the FTP Ports (20,21) & SMTP Ports(25,110,143,465,587,993,995)   to IP addresses originating in Belgium & Bulgaria. Step #1: Specify the Country or Countries to be Denied Scroll down to the Country Code Lists and Settings section and add the country code to CC_DENY_PORTS . Multiple countries can be comma separated with no spaces in between, and you can find a list of ISO 3166-1 alpha-2 codes at https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2. List the port that will be blocked in the specified country in the CC_DENY_PORTS_TCP and CC_DENY_PORTS_UDP fields. Step #2: Save Your Changes and Restart the Firewall Scroll to the bottom of the Firewall Configuration page and click on the Change button. On the next screen, click t...

I have some listed ports for my services management and I want that listed ports only accessible from my country. Yes, you can choose to allowing incoming traffic by port to only a specific country or countries. Generally, this should be a better option than attempting to deny port access to a long list of countries because the firewall be working with a smaller CIDR range against which each incoming request must be checked. My Listed Ports: 22,2030,2031,2086,2087,5550,55004,1025 To limit the ability to connect on a specific port or ports to visitors with IP addresses originating in a specific country or countries, you must: close the ports in the firewall define the country code allowed to connect on those blocked ports specify the blocked ports to be opened for the specified country In this example, we’re allowing access to above  My Listed Ports , to IP addresses based in My Country ( Germany). Step #1: Close the Ports in the Firewall On the Firewall Configurati...

CSF (ConfigServer Firewall) on a Linux system and you block a lot of IP addresses. Servers running iptables with CSF firewall can become slow and bogged down while processing the sometimes hundreds of IP addresses in CSF's iptables chains. Thankfully, it is possible to quickly and easily alleviate this slowdown by installing and configuring a took called ipset. This option allows you to use ipset v6+ for the following csf options: CC_* and /etc/csf/csf.blocklist, /etc/csf/csf.allow, /etc/csf/csf.deny, GLOBAL_DENY, GLOBAL_ALLOW, DYNDNS, GLOBAL_DYNDNS, MESSENGER ipset will only be used with the above options when listing IPs and CIDRs. Advanced Allow Filters and temporary blocks use traditional iptables. To use this option you must have a fully functioning installation of ipset installed either via rpm or source from http://ipset.netfilter.org/ It’s a straight forward process. CentOS, Red Hat and Fedora (yum based) users : # yum install ipset -y Ubuntu or Debian: # sudo...

In our Previous Tutorial Part 4 , We have fixed  Nginx 504 Gateway Time-out for our PrestaShop installation. Now We will run PrestaShop installation again. You have to delete all the tables from DB(datahead_db) that you created for PrestaShop. Open your Browser and visit your domain again. Follow all the steps and also provide DataBase details again and Click on "Next" Your PrestaShop installation is finished successfully. For security purposes, you must delete the "install" folder. Login to your Admin Panel PrestaShop 1.7.6.3 DashBoard:

Welcome to our serious tutorial. When we are installing PrestaShop 1.7.6.3 on CWP7.pro server, we are getting error "Nginx 504 Gateway Time-out " That means CWP The gateway did not receive a timely response from the upstream server or application. 1. Adjust Timeout Value  for proxy settings  # vi /etc/nginx/proxy.inc proxy_connect_timeout 600s; proxy_send_timeout 600; proxy_read_timeout 600; 2. Change the default_socket_timeout  # vi /opt/alt/php-fpm72/usr/php/php.ini default_socket_timeout 600 Change PHP-FPM Configuration: Default Location: /opt/alt/php-fpm72/usr/etc/ /opt/alt/php-fpm72/usr/etc/php-fpm.d/ /opt/alt/php-fpm72/usr/etc/php-fpm.d/users/ 3. Add following value cwpsvc.conf file : # vi /opt/alt/php-fpm72/usr/etc/php-fpm.d/cwpsvc.conf [cwpsvc] listen = /opt/alt/php-fpm72/usr/var/sockets/cwpsvc.sock listen.owner = cwpsvc listen.group = cwpsvc listen.mode = 0640 user = cwpsvc group = cwpsvc ;request_slowlog_timeout = 5s ;slowlog = /opt/alt/p...

Connection Limit Protection: This option configures iptables to offer more protection from DOS attacks against specific ports. It can also be used as a way to simply limit resource usage by IP address to specific server services. This option limits the number of concurrent new connections per IP address that can be made to specific ports This feature does not work on servers that do not have the iptables module xt_connlimit loaded. Typically, this will be with MONOLITHIC kernels. VPS server admins should check with their VPS host provider that the iptables module is included Note: Run /etc/csf/csftest.pl to check whether this option will function on this server Step: Go to your CSF WebUI Panel and Select " Port Flood Settings" : You can set limit for the number of connections to particular port by altering the value “CONLIMIT”. CONNLIMIT = 80;20,443;15 The above value will limit only 20 connections to the port 80 and 15 connections to the port 443 from singl...

MailScanner is a highly respected open source email security system design for Linux-based email gateways. It is used at over 40,000 sites around the world, protecting top government departments, commercial corporations and educational institutions. This technology has fast become the standard email solution at many ISP sites for virus protection and spam filtering. MailScanner scans email for viruses, spam, phishing, malware, and other attacks against security vulnerabilities and plays a major part in the security of a network. Install MailScanner First stop and disable postfix. We will use MailScanner in the future. # systemctl stop postfix # systemctl disable postfix Download MailScanner and install: # cd /usr/local/src/ # git clone https://github.com/MailScanner/v5.git # cd v5 # cd builds # rpm -ivh MailScanner-5.2.2-1.rhel.noarch.rpm # /usr/sbin/ms-configure 1. Hit Enter to start 2. Intsall an MTA? [1] : N 3. Install EPEL? : n 4. Install missing tnef via RPM? ...

I am using MailScanner Email Security Gateway to scan emails for viruses, spam, phishing, malware, and other attacks against security vulnerabilities. Under the hood, MailScanner uses ClamAV(clamd) for virus scan, and uses Spamassassin to scan for spams. I am also using CWP7pro.admin where all packages are already installed and running smoothly. You just need prepare your ClamAV antivirus usable for MailScanner. 1. ClamAVInstallation (Install ClamAV): At first check the below packages are installed or not. If any packages is missing , run the below command to install # yum info clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd # yum install clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd Unrar RPM Sources: http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm  [ This link ...

The Bayesian classifier in Spamassassin tries to identify spam by looking at what are called tokens; words or short character sequences that are commonly found in spam or ham. If I've handed 100 messages to sa-learn that have the phrase penis enlargement and told it that those are all spam, when the 101st message comes in with the words penis and enlargment, the Bayesian classifier will be pretty sure that the new message is spam and will increase the spam score of that message. In order for SpamAssassin to be accurate, you must train it on your specific mail patterns. SpamAssassin has a Bayesian classifier that can be used to help refine the classification of spam mail. The sa-learn interface allows you to train SpamAssassin to recognize good mail and junk mail. You need to train with both spam and ham mails. One type of mail alone will not have any effect. To filter for spam: Save spam into a new mail folder called Spam Save non-spam (ham) into a new folder called Ham. You m...

Please do not try to use the ancient, modified versions of DCC software distributed by some Linux packagers. Those versions do not detect bulk mail as well as more recent versions. Installations using those old versions also have problems using the public DCC servers that often make it necessary to add their IP addresses to the blacklist that protects the public DCC servers. The DCC source is available at  dcc-servers.net  and  Rhyolite Software .  The license on the free source is in the source as well as  dcc-servers.net . The free license is intended to cover individuals and organizations including Internet service providers using DCC to filter their own mail. Organizations selling anti-spam appliances or managed mail services are not eligible for the free license. https://www.dcc-servers.net/dcc/FAQ.html   Distributed Checksum Clearinghouse (DCC) Installation: Open UDP_OUT port 6277 in firewall. DCC RPM Sources: 1. https://www.mirrorservice.o...

Vipul's Razor is a distributed, collaborative, spam detection and filtering network. The primary focus of the system is to identify and disable an email spam before its injection and processing is complete. Open the following port in your firewall: TCP 2703 Outgoing : Razor2 Razor Installation # yum install pyzor perl-Razor-Agent Create Razor Home Directory # mkdir /etc/mail/spamassassin/.razor Enable the Pyzor plugin # vi /etc/mail/spamassassin/v310.pre # Razor2 - perform Razor2 message checks. # loadplugin Mail::SpamAssassin::Plugin::Razor2 Add the following to /etc/mail/spamassassin/local.cf # razor use_razor2 1 razor_config /etc/mail/spamassassin/.razor/razor-agent.conf score RAZOR2_CHECK 3.000 Restart # systemctl restart spamassassin Discover the Razor  # razor-admin -home=/etc/mail/spamassassin/.razor -register # razor-admin -home=/etc/mail/spamassassin/.razor -create # razor-admin -home=/etc/mail/spamassassin/.razor -discover Define Home Directory, Edit /et...

Pyzor is a collaborative, networked system to detect and block spam using digests of messages.Using Pyzor client a short digest is generated that is likely to uniquely identify the email message. This digest is thensent to a Pyzor server to: Check the number of times it has been reported as spam or whitelisted as not-spam Report the message as spam Whitelist the message as not-spam Since the entire system is released under the GPL, people are free to host their own independent servers. There is,however, a well-maintained and actively used public server available (courtesy of SpamExperts) at: public.pyzor.org:24441 Open the following port in your firewall: UDP 24441 Outgoing : Pyzor TCP 24441 Incoming : Pyzor Pyzor RPM Sources: 1.  ftp://mirror.switch.ch/pool/4/mirror/fedora/linux/releases/22/Everything/x86_64/os/Packages/p/pyzor-0.5.0-10.fc21.noarch.rpm [This will not work ] 2. http://209.132.181.8/pub/archive/fedora/linux/releases/22/Everything/x86_64/os/Packages...