Alibaba cloud mining invasion
first of all, the internal security of the system should be well done, the system vulnerability patch should be well done, the firewall policy, which ports to open, which IP to allow, these basic settings should be well done
using some professional security vulnerability scanning tools, alicloud has its own security analysis tool called situation awareness, which can analyze and discover potential intrusion and highly covert attack threats
some management tools can be used to manage Alibaba cloud hosts. It is very convenient to manage Alibaba cloud hosts. You can set the permissions of management members to prevent management confusion, rece the opening of external ports, and check the security vulnerabilities
when encountering DDoS attacks, you need to buy third-party anti DDoS services. In Alibaba cloud market, there are some anti attack procts such as yunn DDoS, Neusoft, server security reinforcement and optimization.
1. Packet flood attack
a method to interrupt the server or local network is packet flood attack, which usually uses Internet control message protocol (ICMP) packet or UDP packet< Disk attack is a more cruel attack, which not only affects the communication of the target computer, but also destroys its hardware. The forged user requests to use the write command to attack the hard disk of the target computer, make it exceed the limit, and force it to shut down<
3. The route is not reachable
usually, DoS attacks are concentrated on the router, and the attacker first gains control and manipulates the target machine. When an attacker can change the routing table entry of a router, the whole network will be unreachable. This kind of attack is very insidious, because it is often inexplicable when it first appears.
Distributed denial of service (DDoS) attack is a common network attack method, its English full name is distributed denial of service? In short, many DoS attack sources attack a server together to form a DDoS attack, thus doubling the power of denial of service attack
usually, the attacker installs the attacker on each "broiler" on the network through the agent, and the agent launches the attack when it receives the instruction
with the cost of DDoS attack getting lower and lower, many people use DDoS to achieve the "offline" function for a website or an article. An article may have a higher ranking in the search engine because of its good content quality. However, if the website cannot be accessed for a long time because of DDoS, the search engine will delete the article from the index and rece the weight of the website, Because it achieves the purpose of "offline" article
it's not easy to deal with DDoS. First of all, we need to find a reliable host supplier. I had a host supplier before. As soon as I found that an IP was blocked by DDoS, I took the initiative to block the IP for several days. In fact, it is a manifestation of insufficient hardware and technical capabilities
foreign host suppliers may not be reliable either. For example, once I was attacked by DDoS, I transferred my blog to Dreamhost space. The fact shows that Dreamhost's ability of anti DDoS is not flattering. After DDoS came, Dreamhost was rude to deal with DDoS and directly blocked all IP addresses in China
generally speaking, DDoS costs money and bandwidth, and it also costs money and bandwidth to solve DDoS. So, if the server is damaged by DDoS, what should we do
1. To ensure the security of the server system
first of all, it is necessary to ensure that there are no vulnerabilities in the server software to prevent attackers from invading. Ensure that the server is up-to-date with security patches. Delete unused services on the server and close unused ports. For the website running on the server, make sure that it has the latest patch and there is no security vulnerability
2. Hide the server's real IP address
do not resolve the domain name directly to the server's real IP address. Do not let the server's real IP leak. Add CDN to the front end of the server for transfer (free CDN can generally prevent about 5g DDoS). If you have sufficient funds, you can buy advanced defense shield machine to hide the server's real IP. Domain name resolution uses CDN's IP, All resolved subdomain names use the IP address of the CDN. In addition, other domain names deployed on the server can not be resolved by real IP, all of them are resolved by CDN
in short, as long as the real IP of the server is not leaked, the prevention of small traffic DDoS below 5g does not cost much, and the free CDN can cope with it. If the attack traffic exceeds 10g, then the free CDN may not be able to withstand. You need to buy some high defense charging CDN. Generally, high defense CDN is more expensive. For example, the 10g protection of Alibaba cloud and Tencent cloud is 781 years in a month. At present, the domestic recommendation with high cost performance is: network cloud acceleration, 10gddos protection package only takes 1190 years, which is cheaper for agents. Related links
generally, the website program has a vulnerability or the server has a vulnerability and is attacked
the server being hacked is the most headache problem for every website administrator, which can also be solved by the security company, Domestic security companies such as sinesafe and green alliance are more professional
check whether suspicious files are generated on the server, whether new accounts are added, and check the command history