I can’t access Plesk Amdin because of DOS attack; can I block a hostname or IP address through SSH? If so, how would I be able to do this?
Thank you!
I can’t access Plesk Amdin because of DOS attack; can I block a hostname or IP address through SSH? If so, how would I be able to do this?
Thank you!
3
Answers
Probably the easiest is to SSH to your box use vim to and add the following to the top of your .htaccess file in the root of your domain (
/var/www/vhosts/yourdomain.com/httpdocs/.htaccess
):Obviously replace the IP address with the one you want to block. Repeat this for any sites you think are being attacked.
If you have iptables you can block it using simple rule:
This rule drops packets coming from IP 1.2.3.4.
iptables -I INPUT -p tcp -s 1.2.3.4 -m statistic –probability 0.5 -j DROP
iptables -I INPUT n -p tcp -s 1.2.3.4 -m rpfilter –loose -j ACCEPT # n would be an numeric index into the INPUT CHAIN — default is append to INPUT chain
iptables -I INPUT -p tcp -m hashlimit –hashlimit-mode srcip -s 1.2.3.4 –hashlimit-srcmask –hashlimit-above 9/second -j DROP
iptables -I INPUT -p tcp -s 1.2.3.4 -m limit –sport 80 –limit 100/second -j ACCEPT
There are countless others for your circumstances.
Sincerely,
ArrowInTree