Sử dụng log Apache để phân tích DDos

Nguồn : http://pastebin.com/raw/MLHtJ7fQ

[root@kiloccnp~]# cat kilo.txt  | cut -d ' ' -f 9 | sort | uniq -c | sort -nr

    698 404
    691 HTTP/1.1"
    168 HTTP/1.0"
     27 403

[root@kiloccnp~]# grep " 404 " kilo.txt  | cut -d ' ' -f 7 | sort | uniq -c | sort -nr

    674 /
    672 "POST
     23 //
      1 /balancer?&data=

[root@kiloccnp~]# grep " 404 " kilo.txt   | cut -d '"' -f 6 | sort | uniq -c | sort -nr

    136 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1; .NET CLR 2.0.50727; InfoPath.2)
    132 Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
    131 Mozilla/4.0 (compatible; MSIE 6.1; Windows XP)
    118 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1
    117 Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)
    113 Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
    109 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
    106 Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
    102 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3
     98 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Win64; x64; Trident/4.0)
     94 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
     92 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1
     21 Mozilla/5.0 (KHTML, like Gecko) Safari/537.36
      1 MyClient/1.0

Installing PDO_OCI and OCI8 PHP extensions on CentOS

I am currently working on a PHP project that requires using an Oracle server as the database. I
This tutorial assumes that you have already installed php and other packages (e.g. php-pdo) you normally need. This was also tested with an installation of Oracle 11g Express. I’m not sure if this will work for higher versions.

Dependencies

Development packages

$ sudo yum install php-pear php-devel zlib zlib-devel bc libaio glibc
$ sudo yum groupinstall "Development Tools"

InstantClient

Apache Web Server Security and Hardening Tips

1. How to hide Apache Version and OS Identity from Errors

When you install Apache with source or any other package installers like yum, it displays the version of your Apache web server installed on your server with the Operating system name of your server in Errors. It also shows the information about Apache modules installed in your server.

Troubleshoot with Apache Logs

$ cat access.log | cut -d ' ' -f 9 | sort | uniq -c | sort -nr
     941 200
     292 500
     290 404
     50 401
     20 400
$ grep " 404 " access.log | cut -d ' ' -f 7 | sort | uniq -c | sort -nr
     17 /manager/html
      3 /robots.txt
      3 /phpMyAdmin/scripts/setup.php
      3 //myadmin/scripts/setup.php
      3 /favicon.ico
$ cat access.log.1 | cut -d '"' -f 6 | sort | uniq -c | sort -nr

Install PHP & Apache from sourcecode

[root@kiloccnp httpd-2.4.23]# yum install libxml2-static.x86_64 libxml2.x86_64 libxml2-devel.x86_64
[root@kiloccnp php-5.6.28]# yum install gsm.x86_64 gsm-devel.x86_64 gsm-tools.x86_64 libxslt.x86_64
[root@kiloccnp php-5.6.28]# yum install icu.x86_64 libicu.x86_64 libicu-devel.x86_64 libicu-doc.noarch
[root@kiloccnp php-5.6.28]# yum install unixODBC.x86_64 unixODBC-devel.x86_64
[root@kiloccnp curl]# yum install libcurl-devel.x86_64 libcurl.x86_64
[root@kiloccnp gd]# yum install dvipng.x86_64 libpng.x86_64 libpng-devel.x86_64 libpng-static.x86_64 gd.x86_64
http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html  (download for oci8 )
[root@kiloccnp ~]# rpm -Uvh oracle-instantclient11.2-basic-11.2.0.4.0-1.x86_64.rpm
[root@kiloccnp ~]# rpm -Uvh oracle-instantclient11.2-devel-11.2.0.4.0-1.x86_64.rpm

Apache Optimization: KeepAlive On or Off

Apache is the most widely used web server on the Internet. Knowing how to get the most out of Apache is very important for a systems administrator. Optimizing Apache is always a balancing act. It’s a case of sacrificing one resource in order to obtain savings in another.

What is KeepAlive

HTTP is a session less protocol. A connection is made to transfer a single file and closed once the transfer is complete. This keeps things simple but its not very efficient.
To improve efficiency something called KeepAlive was introduced. With KeepAlive the web browser and the web server agree to reuse the same connection to transfer multiple files.

How to rotate apache logs

/var/log/httpd/access_log.* {
compress
copytruncate
create 644 root root
rotate 30
size 100K
}
/var/log/httpd/dummy-host.example.com-access_log.* {
compress
copytruncate
create 644 root root
rotate 30
size 10M