Application-Layer DDoS Attack Protection with HAProxy

Re:Application-Layer DDoS Attack Protection with HAProxy by LinuxBender on Friday November 09, 2018 @03:27PM (#18417677)

Thankyou for this.

I make heavy use of HAProxy and use the silent-drop capabilities on my own personal sites. In addition to stick tables, I also use it heavily with acl's that pattern match on common attacks and enumeration.

My favorite stick table uses http_err_cnt to block enumeration attempts.

    stick-table	type integer size 127k expire 30m store http_err_cnt
    acl		abuses sc0_http_err_cnt gt 6
    http-response	silent-drop if abuses

I also find it useful to define known bot user-agents and IP addresses, then add conditional ACL's to enforce my robots.txt, since many search engines just ignore it.

    acl BOTS src -f /opt/.ha/bot.txt
    acl BOTS hdr_sub(user-agent) bash url get lack ing team oog lurp ook rawl bot map dback ltx pider scan bmast robe ithub hatweb ansci rchiv null isco =
    acl FILES path_end .html .pl .jpg .jpeg .gif .png .gz .xz .7z .zip .rar .m3u .ogg .mp3 .mp4 .avi
    acl FILES url_sub /post /upload /images
    acl PROT hdr_sub(host) site1 site2 site3
    http-request silent-drop if BOTS FILES PROT

There's probably a more cpu efficient way to do the above. It was just a quick hack to make robots obey and is not seo friendly at all. Maybe you have ideas how I could optimize that.

[ Parent | on HN ]

Re:Application-Layer DDoS Attack Protection with HAProxy by idealhavoc on Friday November 09, 2018 @05:25PM (#18418569)

For the first example that looks good to catch scanners and the like, though it needs an "http-response track-sc0 src" or nothing will get stored in the stick table. The second example it looks good; since there aren't any regexes in there the ip/substring/end lookups are quite CPU friendly so shouldn't have a large impact even at higher request rates (IP ACL files notably get loaded into a binary tree format and take next to no CPU work to check for a match even with millions of IP's).

[ Parent | on HN ]

Re:Application-Layer DDoS Attack Protection with HAProxy by LinuxBender on Monday November 12, 2018 @11:52AM (#18433720)

Ah yes, I left off the track-sc0 from my config. Good catch. I tried to stay away from regex or long strings. Ty for verifying that it looks ok.

[ Parent | on HN ]

Re:Application-Layer DDoS Attack Protection with HAProxy by bedis9 on Sunday November 11, 2018 @08:28AM (#18426264)

Partially true. Sub matching is stored in chained lists and could take some CPU if improperly used

[ Parent | on HN ]