Iraklis's questions

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy).

#limit the parallel http requests to 50 per class C sized network    
iptables  -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 50 --connlimit-mask 24 -j REJECT --reject-with tcp-reset

I'm using the GoldenEye DOS tool (among others), and in the CentOS connections are successfully denied, however in the debian box nothing happens (CPU goes up to 100%, apache becomes unresponsive)

Any idea of what might be happening? The rule is succesfully added to the IPTABLES rule list

root@bedrock ~ # iptables -L | grep httpflags
REJECT     tcp  --  anywhere             anywhere             tcp dpt:httpflags: FIN,SYN,RST,ACK/SYN #conn src/24 > 50 reject-with tcp-reset

root@bedrock ~ # cat /etc/*-release
PRETTY_NAME="Debian GNU/Linux 7 (wheezy)"
NAME="Debian GNU/Linux"
VERSION_ID="7"
VERSION="7 (wheezy)"
ID=debian
ANSI_COLOR="1;31"
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support/"
BUG_REPORT_URL="http://bugs.debian.org/"

root@bedrock ~ # lsmod | grep ip
xt_multiport           12548  12
ipt_REJECT             12502  3
ipt_LOG                12605  8
iptable_mangle         12536  0
iptable_nat            12928  0
nf_nat                 18242  1 iptable_nat
nf_conntrack_ipv4      14078  16 nf_nat,iptable_nat
nf_defrag_ipv4         12483  1 nf_conntrack_ipv4
nf_conntrack           52720  5 nf_conntrack_ipv4,nf_nat,iptable_nat,xt_state,xt_connlimit
ip6table_filter        12540  0
ip6_tables             22175  1 ip6table_filter
iptable_filter         12536  1
ip_tables              22042  3 iptable_filter,iptable_nat,iptable_mangle
x_tables               19118  14 ip_tables,iptable_filter,ip6_tables,ip6table_filter,iptable_nat,iptable_mangle,xt_tcpudp,xt_state,xt_limit,ipt_LOG,ipt_REJECT,xt_multiport,xt_recent,xt_connlimit

I'm running a shoutcast v1 streaming server on a CentOS box. When I start the server as root, I can stream to 1200-1300 clients without a problem.

However, when I run the server as a different user (ccuser) the shoutcast server freezes when the connections reach to ~1019 something.

I have already edited /etc/security/limits.conf with the appropriate setting for both root & ccuser, and after a reboot, ulimit -a confirms it:

root@nsxxxxxx ~/monitoring # su - ccuser
-bash-4.1$ ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 515170
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 16384
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 1024
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

I'm guessing that there is some other safeguard/setting that prohibits normal users to have more than ~1000 connections on a single port. Anyone has any ideas?

A own a dedicated CentOS box that uses lighttpd to serve www.newdomain.com. However, the same IP used to host an old domain www.olddomain.com.

The box still gets requests for www.olddomain.com.

What's the most effective way to block those requests?

• Through an iptables rule
• By a rule in lighttpd
• Adding a hosts.deny
• Another option that haven't thought of

Note: I do not have access to the name servers or the domain records of www.olddomain.com

I've been a blackberry user for the past 6 years. I've convinced myself to make the switch to an Android device. I have already started some Android development so having an actual android device would be a bonus.

My question: How exactly does push-email works in non blackberry phones? Here is what I have gathered with some deductive reasoning, but please correct me: on BB, there is the Blackberry Internet Service, or Blackberry Enterprise Service. They are servers that RIM controls, and they pool your email accounts (whether it is a gmail account or imap accounts on your own linux boxes) for new emails. Once a new email arrives, they push that email to your phone. They know how/where your phone is (its IP address or another unique characteristic) because every time you subscribe to a GPRS/3G antenna your mobile operator notifies BB that customer X with phone Y can be reached at address Z.

Now what happens in a non-BB scenario? How does my own linux server running imap (say dovecot) knows how to contact my mobile phone to "push" the new emails?

After reading a bit I stumbled upon IMAP IDLE, which from what I understand is an IMAP command that the client (my mobile phone in this instance) uses to say to the server: "Hey , i'm client X, and my address is Y, so if any new email comes push it here".

Here is where I'm gradually losing understanding: Does this mean that each time I switch from one mobile antenna to the next (say i'm driving down the road) my phone will send a new IMAP IDLE command to my dovecot server saying "Hey, my contact address has changed, please use this one".

What happens when you are using both WIFI and 3G? Does your phone issue two IMAP IDLE commands?

Finally, do all mobile phones (with a data plan) have unique IP addresses? If not (say the telco NATs you) how can my imap server initiate a communication to my device?

As you can see I'm a bit lost and I would be grateful for some more information.

Does anyone know of any manufacturer that lists CentOS as an officially suported OS? Fujitsu and Dell don't support it. I'm specifically looking for CentOS support; vendors that only support RHEL are not sufficient for my needs.

I'm setting up ACL permissions in CENTOS.

I'm getting close to the structure that I have in mind however one piece is missing for completing the puzzle.

Is there any way to HIDE a file/directory from a specific user/group?

I'm not talking about not being able to read, change dir to it. I want to completely hide it from the specific user/group (not to show up on ls -la).