I have a RaQ4i and I host a forum site. Yesterday someone attacked to the server (from this site), sending hundreds of http requests at a time. The server was almost crashed. The IP was dynamic so I cannot ban it. How can I protect the server from attacks like that? Is there any security program I must install? Thank you.

Portsentry!

Raq 3/4 package here

http://networking.acomm-hosting.co.uk/pkg/portsentry-1.1-fr5_i386_RaQ.pkg

Our you can do so manually here:
http://www.uk2raq.com/raqfaq/raqfaqshow.php?faq=46

How would PortSentry protect him from a HTTP DOS attack?

Port sentry can be comfigured to monitor certain types of DOS attacks, especially the Smurf type ones which uses ICMP.

I am not too sure if port sentry works well with TFN type (syn flooding) dos attacks though through tcp but I think it does as monitoring is live, and will dump all suspected IP's into the host.deny file.

But then again, alot of DOS attacks can be stopped at the router side. Such as the type 13 ICMP packets.

What to beware is the fake source addresses used in DOS attacks................I would say 99% of all attacks are spoofed.

So guys do you suggest me to use Portsentry? Do I have to any other installation step except installing the pkg package? Thank you!

Is there a firewall pkg for raq4?

Originally posted by Waverz
Is there a firewall pkg for raq4?

IPChains would work well on a RAQ.

IPChains would work well on a RAQ.

Could someone please explain how IPChains works? What does it protect from? Is there any pkg file for installation? URL?

I am not sure if there is a .PKG Package for it. but there is a RPM file. that will work just the same. you then need to configer it via Telnet.


Originally posted by Franki


Could someone please explain what exactly IPChains does? Is there any pkg file for installation? URL?

Try a search on ipchains and you'll get all the information about it you wish (and more :-)).

Goodluck !