Home / server / Questions / 1019627
In Process
Alena
Asked: 2020-06-02 21:22:12 +0800 CST

How can I prevent simultaneous connections from single IP?

  • 772

I am running a Wordpress site on digital ocean droplet, and the droplet is running CentOS with CWP. Website is new so it has very low amount of genuine traffic, on average it has around 3-5 visitors per day. However, the site is under attack since last couple of weeks.

I receive almost daily an email notification by lfd service, about "Excessive process running under user XYZ". A second email, with title "High 5 minute load average alert" right after that.

Sample Line from First Email: (last notification email has around 143 process count with status not killed)

User:XYZ PID:29096 PPID:26959 Run Time:58(secs) Memory:230140(kb) RSS:10104(kb) exe:/usr/local/bin/php-cgi cmd:/usr/local/bin/php-cgi /home/XYZ/public_html/wp-login.php

Second email contains output from different commands ps.txt, vnstat.txt, netstat.txt, apachestatus.html

In the last notification email, there's an error in all files, except apachestatus.html. The error message is, "Unable to obtain SERVICE_NAME output within 10 seconds - Timed out".

In the apachestatus file, I can see 243 idle threads at wp-login.php from single IP.

My questions are:

  1. What is the default time to drop idle connections?
  2. Is there any way to drop idle connections quicker than that? (maybe default time is good, but it is still causing issue in my case so I want to reduce it further)
  3. How can I limit simultaneous requests from certain IP? (to restrict open connection limit to 10 or maybe 20)
  4. What is the best way to handle this and protect server from these type of attacks? (any relevant tool or technique)
denial-of-service apache-2.4 centos7 lfd

1 Answers

  1. The below is really just an answer to address your Fail2Ban comment/question - I could not answer with sufficient depth as a comment.

    To use fail2ban requires more then just basic options. Here is my "secret sauce"

    apache-wplogin.conf:

    # Fail2Ban configuration file
#
# Author: Tim Connors
# Tweeked by David Go
#

[Definition]

# Option:  failregex
# Notes.:  Regexp to catch Apache dictionary attacks on Wrodpress wp-login
# Values:  TEXT
#
#failregex = <HOST>.*] "POST /wp-login.php


#failregex = :80 <HOST> -.*"(GET|POST).*/wp-login.php
#            :443 <HOST> -.*"(GET|POST).*/wp-login.php

failregex = :80 <HOST> -.*(GET|POST).*/wp-login.php.*(HTTP)
            :443 <HOST> -.*(GET|POST).*/wp-login.php.*(HTTP)

    apache-wpxmlrpc.conf 

    [Definition]

# Option:  failregex
# Notes.:  Regexp to catch xmlrpc attacks on Wordpress
# Values:  TEXT
#

 failregex = :80 <HOST>\ -.*(GET|POST).*/xmlrpc\.php.*(HTTP)
            :443 <HOST>\ -.*(GET|POST).*/xmlrpc\.php.*(HTTP)

    Additional lines in jail.local for the above:

    # Short term lockout for Wordpress Brute Force
[apache-wplogin]
logpath = /var/log/apache2/other_vhosts_access.log
maxretry = 8
bantime = 300
findtime = 300
enabled = true

    Note that my Apache is logging in "combined" format from outside VirtualHost directives - I have config lines:

    # Define an access log for VirtualHosts that don't define their own logfile

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined    
CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
    • 0