Tornado and DDoS Attacks

[aliane abdelouahab]

hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

[Andrew Grigorev]

To prevent the DDoS attacks you need to kill that bastards, who doing
the DDoS. To stand against DDoS you need to write a fast and scalable
web-applications. Tuning the server to resist the
network/session/http-layer attacks is only a part of success. It does
nothing if your application would produce 100% CPU load on 10 RPS.

Though tornado is a pretty good HTTP server due its async nature, it is
not a good idea to put it on the front. Since it is recommended to put
it behind the other web-server (nginx/lighttpd/cherokee), there are no
tornado-specific requirements to protect against network layer attacks.

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

[Andrew Grigorev]

btw. Captcha is to protect against spam bots. Not DDoS.

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

[Srini Kommoori]

As suggested, I would use nginx/haproxy before tornado(or any app server).

I have been using https://www.cloudflare.com/overview so far and really
happy with it. I don't know whether it saved me from DDoS though.

Post by Andrew Grigorev
btw. Captcha is to protect against spam bots. Not DDoS.

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.**com/showthread.php?t=1622254&**s=**
7fbdee01df5bc01efcc9b9a20c7bb2**2c&p=13191216#post13191216<http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216>
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

--
Andrew

[Russ Weeks]

On a side-note: in a configuration like the one recommended, with nginx
front-ending tornado, is there any security benefit to running tornado in
HTTPS? Assuming that the nginx and tornado processes are colocated, of
course.

Thanks,
-Russ

Post by Srini Kommoori
As suggested, I would use nginx/haproxy before tornado(or any app server).
I have been using https://www.cloudflare.com/overview so far and really
happy with it. I don't know whether it saved me from DDoS though.

Post by Andrew Grigorev
btw. Captcha is to protect against spam bots. Not DDoS.

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.**com/showthread.php?t=1622254&**s=**
7fbdee01df5bc01efcc9b9a20c7bb2**2c&p=13191216#post13191216<http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216>
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

--
Andrew

[Alek Storm]

Post by Russ Weeks
On a side-note: in a configuration like the one recommended, with nginx
front-ending tornado, is there any security benefit to running tornado in
HTTPS? Assuming that the nginx and tornado processes are colocated, of
course.

No. Nginx would be decrypting data from the downstream TLS session, then
packaging it into a new TLS session it's established with the Tornado
machine. The nginx machine could prove its own identity, but not that it
is, in fact, talking to the downstream endpoint it claims it is (through a
client cert). You'd take a performance hit for no additional security.

OTOH, if you were using nginx just as a TCP-level load balancer (and not to
serve static content), then it could just proxy the TLS packets to Tornado,
but I don't think that's what you meant.

Alek

Thanks,

Post by Russ Weeks
-Russ

Post by Srini Kommoori
As suggested, I would use nginx/haproxy before tornado(or any app server).
I have been using https://www.cloudflare.com/overview so far and really
happy with it. I don't know whether it saved me from DDoS though.

Post by Andrew Grigorev
btw. Captcha is to protect against spam bots. Not DDoS.

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.**com/showthread.php?t=1622254&**s=**
7fbdee01df5bc01efcc9b9a20c7bb2**2c&p=13191216#post13191216<http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216>
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

--
Andrew

[Didip Kerabat]

The best way to block network related attack is to use firewall.

Some attacks aren't just targeting HTTP, it can attack ICMP or SYN as well.

http://www.cyberciti.biz/faq/how-do-i-block-an-ip-on-my-linux-server/
http://www.cyberciti.biz/faq/block-entier-country-using-iptables/

- Didip -

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

[Shuttle]

As the others told you, Captcha won't cut it for you. You could try DDoS
Deflate, but then you run the risk of cutting some of your legit users out.
See, what Deflate does is monitor requests and blacklists IP's with
"abnormal" (defined by you) request frequency. If you don't need UDP, you
may try and ask your datacenter to block it completely for you. When you're
dealing with SYN Flood with spoofed IP's it's really hard to do on your
own. Cloudflare might save you from minor DDoS but it will not provide real
protection. Depending on how bad the attacks are and how feasible it is for
you, you may want to see what the proxy-shield providers can do for you. My
butt was saved a few times by Vistnet with SLA up to 1 mpps, but then again
I don't know if you need that much protection-wise. Can you give some
metrics here, so we can try and see what's going on with your attacks and
hopefully come up with a more precise answer?

Post by aliane abdelouahab
hi
i was searching for a solution about the DDoS, and it came in my mind
using captcha, but the problem is captcha is in the software layer,
and the attacks occurs in network layer
http://forums.digitalpoint.com/showthread.php?t=1622254&s=7fbdee01df5bc01efcc9b9a20c7bb22c&p=13191216#post13191216
and because tornado is asynchronous/non-blocking, so how to prevent
the DDoS attacks?

[aliane abdelouahab]

thank you for replies and sorry for being late.
so from what i understand, the best way to defend from DDoS is to use
a third party solution, or try to tell to all internet users to use a
good antivirus to avoid a trojan who will execute the DDoS!
Nginx is a good a idea and it will be there, so Ngnix will play as a
load balancer, a static files server, and a DDoS protector!
so, using only Tornado is not a good idea!
thank you again :)

[aliane abdelouahab]

CloudFare is a third party solution, but DDoS Deflate http://deflate.medialayer.com/
seems to be a good idea, it's only a simple monitor to Netstat, so
it's the admin who will control every thing, and that will be a good
idea?