ATTACK

A quick and useful command for checking if a server is under ddos:
netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n

That will list the IPs taking the most amounts of connections to a server. It is important to remember that ddos is becoming more sophisticated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.

Another very important thing to look at is how many active connections your server is currently processing.

netstat -n | grep :80 |wc -l

netstat -n | grep :80 | grep SYN |wc -l

The first command will show the number of active connections that are open to your server. Many of the attacks typically seen work by starting a connection to the server and then not sending any reply making the server wait for it to time out. The number of active connections from the first command is going to vary widely but if you are much above 500 you are probably having problems. If the second command is over 100 you are having trouble with a syn attack.

To Block a certain IP address that on server .Please use following commands

—————–command——————————

route add ipaddress reject

for example route add 192.168.0.168 reject

You can check whether given IP is blocked on server by using following command

route -n |grep IPaddress

—————–command——————————

OR

use follwoing command to block a ip with iptables on server
—————–command——————————
iptables -A INPUT 1 -s IPADRESS -j DROP/REJECT

service iptables restart

service iptables save

—————–command——————————

Then KILL all httpd connection and restarted httpd service by using following command

killall -KILL httpd

service httpd startssl


additionally you can check the connection ports here


lsof | grep ESTABLISHED
lsof | grep LISTEN

lsof -p PID

POSTGRESQL ERROR

IF you get an error given below

FATAL 1: IDENT authentication failed for user "postgres"'

Do the following to fix it.

# vi /var/lib/pgsql/data/pg_hba.conf


Add the line

host all 127.0.0.0 255.255.255.255 trust

:wq // save the file


The /var/lib/pgsql/data/pg_hba.conf will look like this.

# TYPE DATABASE USER CIDR-ADDRESS METHOD

#local all all ident sameuser
host all all 127.0.0.1/32 trust




# service postgresql restart

INSTALLING MAVEN

# cd /opt


# wget -c http://www.eng.lsu.edu/mirrors/apache//maven/binaries/apache-maven-3.0-bin.tar.gz

# tar xvzf apache-maven-3.0-bin.tar.gz

# vi /etc/profile

Add the following lines to the end of the file

M2_HOME=/opt/apache-maven-3.0
export M2_HOME
PATH=$PATH:$M2_HOME/bin

:wq // save the file


# source /etc/profile

Apache maven is installed and ready to use.

Tux blog: INSTALLING OPENNMS

Tux blog: INSTALLING OPENNMS: "OpenNMS is the world's first enterprise-grade network management system developed under the open source model. As with any complex and power..."

INSTALLING OPENNMS

OpenNMS is the world's first enterprise-grade network management system developed under the open source model. As with any complex and powerful system, getting it installed and configured can take a little effort.

Minimum Requirements
--------------------

* A 1 GHz Pentium III (or equivalent processor) or better. OpenNMS can also take advantage of multiple processors.

* A minimum of 256 MB of RAM, although 512 MB is strongly recommended. The OpenNMS Java Virtual Machine benefits from large amounts of memory, up to 2 GB, and more if using a 64-bit processor.

* OpenNMS requires about 200 MB of disk space for the program files. In addition, each data variable collected requires, by default, a little under 300 KB of disk space.


Configure RPM-based Distributions with Yum
-------------------------------------------

[root@localhost ~]# yum install yum-fastestmirror


Install the OpenNMS Repository RPM
-----------------------------------

rpm -Uvh http://yum.opennms.org/repofiles/opennms-repo-snapshot-fc7.noarch.rpm

Or, to install the latest unstable release on CentOS or RHEL 5, you would run:

rpm -Uvh http://yum.opennms.org/repofiles/opennms-repo-unstable-rhel5.noarch.rpm

Installing Java on RPM-based Distributions Using Yum
----------------------------------------------------

[root@localhost ~]# yum install jdk


Installing PostgreSQL on RPM-Based Distributions Using Yum
----------------------------------------------------------

[root@localhost ~]# yum -y install postgresql-server


Configure PostgreSQL
--------------------

Locate the Postgres "data" directory. Often this is /var/lib/pgsql/data. You should then find the two files we need to modify in that directory.

First we need to make sure PostgreSQL is listening on an IP socket, and not just a local unix socket.


Edit postgresql.conf File and add the following.

listen_addresses = 'localhost'

max_connections = 256

max_connections = 256



Customizing the pg_hba.conf File
--------------------------------

Add the below lines.

# TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD
local all all trust
host all all 127.0.0.1 255.255.255.255 trust
host all all ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff trust


Creating the PostgreSQL Database
---------------------------------


# /etc/init.d/potgresql start


Installing JICMP on RPM-Based Distributions Using YUM
-----------------------------------------------------


[root@localhost ~]# yum install jicmp



Installing OpenNMS
------------------
------------------


[root@localhost ~]# yum install opennms-*

Configure Java for OpenNMS
--------------------------

[root@localhost ~]# /opt/opennms//bin/runjava -s


The desired outpu is given below:


runjava: Looking for an appropriate JRE...
runjava: Checking for an appropriate JRE in JAVA_HOME...
runjava: skipping... JAVA_HOME not set
which: no java in (/usr/lib/qt-3.3/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/lib/ccache:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/opennms/bin:/root/bin)
runjava: did not find a JRE in user's path
runjava: searching for a good JRE...
runjava: found a good JRE in "/usr/java/jdk1.5.0_18/bin/java"
runjava: value of "/usr/java/jdk1.5.0_18/bin/java" stored in configuration file
You have new mail in /var/spool/mail/root


Configure a specific JRE
-------------------------


If you need to configure specific JRE do the following:

[root@localhost]# /opt/opennms/bin/runjava -S


Run the OpenNMS Installer Application
-------------------------------------

[root@localhost ~]# /opt/opennms/bin/install -l /usr/local/lib -dis




Login to the Web Application
-----------------------------

By default, OpenNMS's built-in web server listens on port 8980, so point your browser at http://:8980/opennms/


The initial user name is "admin" and the password is "admin".

Enjoyyyy...............


If you need any further assistance. Ping me

Email: vasanth462@gmail.com