There really is nothing you can do to prevent a DDoS attack. NO software or countermeasures can stand up to attacks from 100 servers at once. All you can do is take preventive measures, and respond quickly if an attack takes place.
1. Create and implement a good security policy
2. Set up a firewall which does ingress and egress filtering at the gateway
3. Use host-based intrusion detection on your gateway/hosts to alert you to port scans and break-in attempts
To prevent your network from being used as a slave follow these steps:
Conduct regular audits on each host on the network to find installed DDoS tools and vulnerable applications.
Use tools like Rkdet, Rootkit Hunter, or chkrootkit to find if a rootkit has been installed on your system.
Perform a general security audit on your systems on a regular basis
Keep your systems up to date to minimize software vulnerabilities
Check for rootkits
Check logs for evidence of port sniffing, etc.
Check for hidden processes by comparing the output of 'ps' and 'lsof'.
Check system binaries with, e.g., Tripwire to see if they've been changed since your last snapshot
Check for open email relays
Check for malicious cron entries
Check /dev /tmp /var directories for odd files (i.e., '...', wrong permissions/ownership on device files, etc.)
Check if your backups are maintained
Check for unwanted users and groups (examine /etc/passwd)
Check for and disable any unneeded services
Check for SUID, SGID, and 'nouser' files on your system with the 'find' command
Check the system performance (memory and CPU usage); note the average levels
|
Subscribe to RSS
Linear Mode
