ForumsHQ

Recently ThatOnePlace was hit with a DoS (Denial of Service) attack in some fucked up attempt at killing there system. That seems to have been averted, but now Lunar is the one being targeted with more than 3 attacks in a half-hour span. Im open to suggestions as to what to do with this. This is my setup, if you have any ideas as to help block this problem please let us know. This is my Network Rig:

Worldgroup Server:

PIII 500

786 megs of RAM

8 gig Fujitsu HD

Running Windows XP

Web/Email/Tradewars Server

AMD XP 1600+

512 megs Corsair PC2700 DDR RAM

45 gig Maxtor 7200 RPM HD

Running Windows 2000

External:

Linksys 10/100 BEFSR11 router

Zone Alarm integrated Software firewall

File Server:

AMD Thunderbird 1ghz

Gigabyte Mobo

256 megs PNY PC2100 DDR RAM

any help would be great.

Get rid of WEB on the WG server... there is a vulnerability with it!!!

I was hit with about 50 of them in a 10 minute span... therefore no more Web stuff on the server..

Close ALL ports except for a select few to your WG server

ie. Port 23 = telnet

port 80 = web

port 21 = FTP

No need for the software firewall. The Linksys router is a firewall in itself.

Im aware of that, my web server uses Apache

but its running with WG in the background RIGHT.. STILL a vulnerability

Worldgroup run on its own seperate server,just like Apache does, there not on the same PC.

ah... my bad... then how did you get an attack... only have port 23 open to the WG comp..

Port 80 to the web comp... plus the email ports ( I am drawing a blank)

and File server is Local files?

Quote (iNViSiGOD @ April 08 2002,22:30)Recently ThatOnePlace was hit with a DoS (Denial of Service) attack in some fucked up attempt at killing there system. That seems to have been averted, but now Lunar is the one being targeted with more than 3 attacks in a half-hour span. Im open to suggestions as to what to do with this. This is my setup, if you have any ideas as to help block this problem please let us know. This is my Network Rig:

Worldgroup Server:

PIII 500

786 megs of RAM

8 gig Fujitsu HD

Running Windows XP

Web/Email/Tradewars Server

AMD XP 1600+

512 megs Corsair PC2700 DDR RAM

45 gig Maxtor 7200 RPM HD

Running Windows 2000

External:

Linksys 10/100 BEFSR11 router

Zone Alarm integrated Software firewall

File Server:

AMD Thunderbird 1ghz

Gigabyte Mobo

256 megs PNY PC2100 DDR RAM

any help would be great. [/quote]

how bout the software and version #'s you are using and what exploits are available for each?

First of all, DoS attacks are pretty hard to stop completely, but you can make it more difficult. I assume you already know who is doing this? Do you have auditing set up to log IPs? I hope they know that they're breaking the law, and if it was my server that was getting attacked, they would be doing jail time

But for starters, use a port scanner and find any and all ports that are open on your PCs, and disable/close any ports or services that aren't necessary. Also, make sure WG is not running any extra services that you don't need, because by default it runs FTP, web, telnet, finger(?), and some others (it looks like you are already aware of this).

Anyhow, it's really late, so I'll post again on this tomorrow, or you can catch me at thatoneplace or justanotherbbs (Dark)

If you know the IP address, I know theres a file in WG that you can put in the IP and itll block them from accessing anything on the system.