Preventing a “Denial of Service” (DOS) attack on a server is a major part of securing a server.
In a typical denial of service attack, the attacker logs into the server, starts a process that continuously forks a new process until all the resources on the server are used up. At that point the server has in effect been knocked out of service because all it’s resources are being consumed by one user’s dummy processes.
The code below is known as a fork bomb:
$ forkbomb(){ forkbomb|forkbomb & } ; forkbomb
Limiting the maximum resources available to users and groups is an important part of configuring a production system. To limit resources, you must add the user name, group or all users to /etc/security/limits.conf file and impose process limitations.
Understanding tne “/etc/security/limits.conf” file
Each line describes a limit for a user in the form:
Where:
a user name
a group name, with @group syntax
the wildcard *, for default entry
the wildcard %, can be also used with %group syntax, for maxlogin limit
“soft” for enforcing the soft limits
“hard” for enforcing hard limits
core – limits the core file size (KB)
core – limits the core file size (KB)
data – max data size (KB)
fsize – maximum filesize (KB)
memlock – max locked-in-memory address space (KB)
nofile – max number of open files
rss – max resident set size (KB)
stack – max stack size (KB)
cpu – max CPU time (MIN)
nproc – max number of processes
as – address space limit
maxlogins – max number of logins for this user
maxsyslogins – max number of logins on the system
priority – the priority to run user process with
locks – max number of file locks the user can hold
sigpending – max number of pending signals
msgqueue – max memory used by POSIX message queues (bytes)
nice – max nice priority allowed to raise to
rtprio – max realtime priority
chroot – change root to directory (Debian-specific)
Login as the root and open configuration file:
# vi /etc/security/limits.conf
# The following will prevent a DOS fork bomb by user guest, group students, faculty or
# pusers
guest hard nproc 300
@student hard nproc 50
@faculty soft nproc 100
@pusers hard nproc 200
The configuration above will prevent anyone in the student group from having more than 50 processes, faculty and pusers group limit is set to 100 and 200. guest can create only 300 processes. Please note that both KDE and Gnome desktop environments launch many process.