Ondersteuning > Server en netwerk
Beveiliging tegen DDoS
HWE64:
Ik heb dit op een oude test laptop gezet maar weet totaal niet of dit goed is wat in de terminal staat.
--- Code: ---henk@henk-SATELLITE-C855-22E:~$ sysctl -p /etc/sysctl.d/99-antiddos.cnf
sysctl: permission denied on key "kernel.printk", ignoring
sysctl: permission denied on key "kernel.panic", ignoring
sysctl: permission denied on key "kernel.sysrq", ignoring
sysctl: permission denied on key "kernel.shmmax", ignoring
sysctl: permission denied on key "kernel.shmall", ignoring
sysctl: permission denied on key "kernel.core_uses_pid", ignoring
sysctl: permission denied on key "kernel.msgmnb", ignoring
sysctl: permission denied on key "kernel.msgmax", ignoring
sysctl: permission denied on key "vm.swappiness", ignoring
sysctl: permission denied on key "vm.dirty_ratio", ignoring
sysctl: permission denied on key "vm.dirty_background_ratio", ignoring
sysctl: permission denied on key "fs.file-max", ignoring
sysctl: permission denied on key "net.core.netdev_max_backlog", ignoring
sysctl: permission denied on key "net.core.rmem_default", ignoring
sysctl: permission denied on key "net.core.rmem_max", ignoring
sysctl: permission denied on key "net.core.wmem_default", ignoring
sysctl: permission denied on key "net.core.wmem_max", ignoring
sysctl: permission denied on key "net.core.somaxconn", ignoring
sysctl: permission denied on key "net.core.optmem_max", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh1", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh2", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh3", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_interval", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_stale_time", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_max", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_loose", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_established", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_fin_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_last_ack", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_recv", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_sent", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_time_wait", ignoring
sysctl: permission denied on key "net.ipv4.tcp_slow_start_after_idle", ignoring
sysctl: permission denied on key "net.ipv4.ip_local_port_range", ignoring
sysctl: permission denied on key "net.ipv4.ip_no_pmtu_disc", ignoring
sysctl: permission denied on key "net.ipv4.route.flush", ignoring
sysctl: permission denied on key "net.ipv4.route.max_size", ignoring
sysctl: permission denied on key "net.ipv4.icmp_echo_ignore_broadcasts", ignoring
sysctl: permission denied on key "net.ipv4.icmp_ignore_bogus_error_responses", ignoring
sysctl: permission denied on key "net.ipv4.tcp_congestion_control", ignoring
sysctl: permission denied on key "net.ipv4.tcp_mem", ignoring
sysctl: permission denied on key "net.ipv4.udp_mem", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_rmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_wmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_wmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_tw_buckets", ignoring
sysctl: cannot stat /proc/sys/net/ipv4/tcp_tw_recycle: Bestand of map bestaat niet
sysctl: permission denied on key "net.ipv4.tcp_tw_reuse", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_orphans", ignoring
sysctl: permission denied on key "net.ipv4.tcp_window_scaling", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rfc1337", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syncookies", ignoring
sysctl: permission denied on key "net.ipv4.tcp_synack_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syn_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_syn_backlog", ignoring
sysctl: permission denied on key "net.ipv4.tcp_timestamps", ignoring
sysctl: permission denied on key "net.ipv4.tcp_sack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_ecn", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fin_timeout", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_time", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_intvl", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_probes", ignoring
sysctl: permission denied on key "net.ipv4.tcp_no_metrics_save", ignoring
sysctl: permission denied on key "net.ipv4.ip_forward", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.send_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_source_route", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.rp_filter", ignoring
henk@henk-SATELLITE-C855-22E:~$
--- Einde van code ---
kan iemand mij een tip geven?
MKe:
--- Citaat van: Bloom op 2022/02/23, 14:40:46 ---Die heb ik dus gegeven!
--- Einde van citaat ---
inderdaad, mijn dank dus.
Bloom:
--- Citaat van: HWE64 op 2022/02/23, 16:01:25 ---Ik heb dit op een oude test laptop gezet maar weet totaal niet of dit goed is wat in de terminal staat.
--- Code: ---henk@henk-SATELLITE-C855-22E:~$ sysctl -p /etc/sysctl.d/99-antiddos.cnf
sysctl: permission denied on key "kernel.printk", ignoring
sysctl: permission denied on key "kernel.panic", ignoring
sysctl: permission denied on key "kernel.sysrq", ignoring
sysctl: permission denied on key "kernel.shmmax", ignoring
sysctl: permission denied on key "kernel.shmall", ignoring
sysctl: permission denied on key "kernel.core_uses_pid", ignoring
sysctl: permission denied on key "kernel.msgmnb", ignoring
sysctl: permission denied on key "kernel.msgmax", ignoring
sysctl: permission denied on key "vm.swappiness", ignoring
sysctl: permission denied on key "vm.dirty_ratio", ignoring
sysctl: permission denied on key "vm.dirty_background_ratio", ignoring
sysctl: permission denied on key "fs.file-max", ignoring
sysctl: permission denied on key "net.core.netdev_max_backlog", ignoring
sysctl: permission denied on key "net.core.rmem_default", ignoring
sysctl: permission denied on key "net.core.rmem_max", ignoring
sysctl: permission denied on key "net.core.wmem_default", ignoring
sysctl: permission denied on key "net.core.wmem_max", ignoring
sysctl: permission denied on key "net.core.somaxconn", ignoring
sysctl: permission denied on key "net.core.optmem_max", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh1", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh2", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh3", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_interval", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_stale_time", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_max", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_loose", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_established", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_fin_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_last_ack", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_recv", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_sent", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_time_wait", ignoring
sysctl: permission denied on key "net.ipv4.tcp_slow_start_after_idle", ignoring
sysctl: permission denied on key "net.ipv4.ip_local_port_range", ignoring
sysctl: permission denied on key "net.ipv4.ip_no_pmtu_disc", ignoring
sysctl: permission denied on key "net.ipv4.route.flush", ignoring
sysctl: permission denied on key "net.ipv4.route.max_size", ignoring
sysctl: permission denied on key "net.ipv4.icmp_echo_ignore_broadcasts", ignoring
sysctl: permission denied on key "net.ipv4.icmp_ignore_bogus_error_responses", ignoring
sysctl: permission denied on key "net.ipv4.tcp_congestion_control", ignoring
sysctl: permission denied on key "net.ipv4.tcp_mem", ignoring
sysctl: permission denied on key "net.ipv4.udp_mem", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_rmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_wmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_wmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_tw_buckets", ignoring
sysctl: cannot stat /proc/sys/net/ipv4/tcp_tw_recycle: Bestand of map bestaat niet
sysctl: permission denied on key "net.ipv4.tcp_tw_reuse", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_orphans", ignoring
sysctl: permission denied on key "net.ipv4.tcp_window_scaling", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rfc1337", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syncookies", ignoring
sysctl: permission denied on key "net.ipv4.tcp_synack_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syn_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_syn_backlog", ignoring
sysctl: permission denied on key "net.ipv4.tcp_timestamps", ignoring
sysctl: permission denied on key "net.ipv4.tcp_sack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_ecn", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fin_timeout", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_time", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_intvl", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_probes", ignoring
sysctl: permission denied on key "net.ipv4.tcp_no_metrics_save", ignoring
sysctl: permission denied on key "net.ipv4.ip_forward", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.send_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_source_route", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.rp_filter", ignoring
henk@henk-SATELLITE-C855-22E:~$
--- Einde van code ---
kan iemand mij een tip geven?
--- Einde van citaat ---
Zoals ik schreef moet je dat als ROOT uitvoeren, dus met sudo ervoor!
HWE64:
@Bloom bedankt. Dus deze pc met deze distriibutie kan niet gebruikt worden voor een DDos aanval.
--- Code: ---henk@henk-SATELLITE-C855-22E:~$ sudo sysctl -p /etc/sysctl.d/99-antiddos.cnf
[sudo] wachtwoord voor henk:
kernel.printk = 4 4 1 7
kernel.panic = 10
kernel.sysrq = 0
kernel.shmmax = 4294967296
kernel.shmall = 4194304
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5
fs.file-max = 2097152
net.core.netdev_max_backlog = 262144
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864
net.core.somaxconn = 65535
net.core.optmem_max = 25165824
net.ipv4.neigh.default.gc_thresh1 = 4096
net.ipv4.neigh.default.gc_thresh2 = 8192
net.ipv4.neigh.default.gc_thresh3 = 16384
net.ipv4.neigh.default.gc_interval = 5
net.ipv4.neigh.default.gc_stale_time = 120
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 20
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.route.flush = 1
net.ipv4.route.max_size = 8048576
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.udp_rmem_min = 16384
net.ipv4.tcp_wmem = 4096 87380 33554432
net.ipv4.udp_wmem_min = 16384
net.ipv4.tcp_max_tw_buckets = 1440000
sysctl: cannot stat /proc/sys/net/ipv4/tcp_tw_recycle: Bestand of map bestaat niet
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_orphans = 400000
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 10
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1
henk@henk-SATELLITE-C855-22E:~$
--- Einde van code ---
Bloom:
Een pc hang je doorgaans niet met een publiek ip-adres op het internet, dus voor een gewone desktoppc is dat zinloos.
Maar een Linux server of UTM of firewall die wél rechtstreeks aan internet hangt met een publiek ip-adres, zou zoiets moeten doen.
Navigatie
[0] Berichtenindex
[#] Volgende pagina
[*] Vorige pagina
Naar de volledige versie