Protect servers from attack spamming, scanning, and Harvesting dDoS attacks

Fire security to the server will come with a variety of ways. Most often it may be SPAM email that will come to your mailbox. Or may be scanning the ip addres will overwrite your server. There are several ways to attack melawah all of that, for example, with only installing SpamAssassin on our server. Akan resource server automatically but we will be used to run SpamAssassin this. For example, the CPU is the server that will be the higher or the more memory we have a few.
Moreover, if the attack comes with SPAM email repeatedly in large numbers, to be sure the CPU or memory will be used to run SpamAssassin this process.

So in this paper the author would like to introduce how to prevent attacks in this top layer with the kernel using iptables. Because iptables is blocked with the automatic resource (CPU, Memory) our server will not be used at all. When there is a request from list ip address the problem of spamhaus.org, it will be directly in this block through iptables. Thus, automatic service-service we will be running normally, without interruption or additional burden.

Here is a short script that we can install in our server. How this script is very simple, the first list will take the ip address that was registered in the spamhaus.org (http://www.spamhaus.org/drop/drop.lasso) as an ip address that is often problematic due to SPAM attacks, scanning or DoS.

1. ILE="/tmp/drop.lasso"
2. URL="http://www.spamhaus.org/drop/drop.lasso"
3. echo ""
4. echo -n "Applying DROP list to existing firewall..."
5. [ -f $FILE ] && /bin/rm -f $FILE || :
6. cd /tmp
7. wget $URL
8. #iptables policy di hapus
9. /sbin/iptables -F
10. #jalankan policy yang sudah ada
11. ./regular_rules
13. blocks=$(cat $FILE | egrep -v '^;' | awk '{ print $1}')
14. /sbin/iptables -N droplist
15. for ipblock in $blocks
16. do
17. /sbin/iptables -A droplist -s $ipblock -j LOG --log-prefix "DROP List Block"
18. /sbin/iptables -A droplist -s $ipblock -j DROP
19. done
20. /sbin/iptables -I INPUT -j droplist
21. /sbin/iptables -I OUTPUT -j droplist
22. /sbin/iptables -I FORWARD -j droplist
23. echo "...Done"
24. /bin/rm -f $FILE
    

regular_rules is that we run the script before running the script above. This script contains the policy of iptables before we have removed with the command iptables-F. Certainly, if you do not have a policy in your iptables, regular_rules line is not needed.