Layer 4 und Layer 7 DDoS-Angriffe: Erkennung und Schutz

Normale TCP-Verbindung:
Client → SYN → Server
Client ← SYN-ACK ← Server
Client → ACK → Server
✓ Verbindung hergestellt

SYN-Flood:
Angreifer → SYN → Server
Angreifer ← SYN-ACK ← Server
Angreifer → (sendet kein ACK)
✗ Halb-offene Verbindungen sammeln sich an

# Halb-offene Verbindungen prüfen
ss -s

# SYN-RECV-Verbindungen auflisten
ss -tnp state syn-recv

# Verbindungsstatus-Verteilung
ss -ant | awk '{print $1}' | sort | uniq -c | sort -rn

# SYN-Anzahl nach Quell-IP
ss -tnp state syn-recv | awk '{print $4}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# SYN-Cookies aktivieren
sudo sysctl -w net.ipv4.tcp_syncookies=1

# SYN-Backlog erhöhen
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=65536

# SYN-ACK-Wiederholungsversuche reduzieren
sudo sysctl -w net.ipv4.tcp_synack_retries=2

# Dauerhaft machen
cat >> /etc/sysctl.conf << 'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.tcp_synack_retries = 2
net.core.somaxconn = 65536
EOF
sudo sysctl -p

# UDP-Verkehr überwachen
sudo tcpdump -i eth0 udp -c 1000 -nn

# Unnötige UDP-Ports schließen
sudo iptables -A INPUT -p udp --dport 19 -j DROP   # chargen
sudo iptables -A INPUT -p udp --dport 69 -j DROP   # TFTP
sudo iptables -A INPUT -p udp --dport 111 -j DROP  # portmap

# UDP-Rate-Limiting
sudo iptables -A INPUT -p udp -m limit --limit 100/s --limit-burst 200 -j ACCEPT
sudo iptables -A INPUT -p udp -j DROP

# NTP-Monlist deaktivieren
echo "disable monitor" >> /etc/ntp.conf
sudo systemctl restart ntpd

# Memcached nur an localhost binden
echo "-l 127.0.0.1" >> /etc/memcached.conf
sudo systemctl restart memcached

# HTTP-Anfragezahl überwachen (Nginx)
tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# Anfragen pro Sekunde
awk '{print $4}' /var/log/nginx/access.log | cut -d: -f1-3 | sort | uniq -c | sort -rn | head -10

limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=api:10m rate=5r/s;
limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    limit_req zone=general burst=20 nodelay;
    limit_conn addr 50;
    
    location /api/ {
        limit_req zone=api burst=10 nodelay;
    }
}

http {
    client_header_timeout 10s;
    client_body_timeout 10s;
    send_timeout 10s;
    keepalive_timeout 15s;
    
    limit_conn_zone $binary_remote_addr zone=conn:10m;
    limit_conn conn 20;
}

cat >> /etc/sysctl.conf << 'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.tcp_synack_retries = 2
net.netfilter.nf_conntrack_max = 1000000
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 65536
net.core.somaxconn = 65536
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.rp_filter = 1
EOF
sudo sysctl -p

#!/bin/bash
# Ungültige Pakete verwerfen
iptables -A INPUT -m state --state INVALID -j DROP

# SYN-Prüfung für neue Verbindungen
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# XMAS-Pakete verwerfen
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# NULL-Pakete verwerfen
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# SYN-Flood-Schutz
iptables -A INPUT -p tcp --syn -m limit --limit 100/s --limit-burst 200 -j ACCEPT

# Verbindungslimit pro IP
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j DROP
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 50 -j DROP