服务器被cc攻击出现504，求大家帮忙看看我的配置
本帖最后由 魔尊 于 2015-1-23 12:33 编辑服务器里面就放了一个重要的txt文件，大概有10KB，理论来说正常用户1分钟不会连续打开此文件3次以上
刚刚被cc出现504，服务器配置是Q9300 8G
下面是我的Nginx的配置，请大家帮我看看是不是哪里设置的不够好，在这谢谢各位了
userwww www;
worker_processes auto;
error_log/home/wwwroot/index/log/nginx_error.logcrit;
pid/usr/local/nginx/logs/nginx.pid;
#Specifies the value for maximum file descriptors that can be opened by this process.
worker_rlimit_nofile 512000;
events
{
use epoll;
worker_connections 200000;
}
http
{
includemime.types;
default_typeapplication/octet-stream;
server_names_hash_bucket_size 128;
client_header_buffer_size 4k;
large_client_header_buffers 4 4k;
client_max_body_size 50m;
limit_req2_zone $binary_remote_addr $request_uri zone=one:3m rate=2r/s;
limit_req2_zone $binary_remote_addr $uri zone=two:3m rate=20r/s;
limit_req2_zone $uri zone=three:3m rate=200r/s;
sendfile on;
tcp_nopush on;
keepalive_timeout 60 60;
fastcgi_connect_timeout 300;
fastcgi_send_timeout 300;
fastcgi_read_timeout 300;
fastcgi_buffer_size 16k;
fastcgi_buffers 16 16k;
fastcgi_busy_buffers_size 16k;
fastcgi_temp_file_write_size 16k;
fastcgi_intercept_errors on;
proxy_cache_valid 200 304 12h;
proxy_cache_key $scheme://$host$request_uri;
proxy_temp_path /home/amproxy_cache_tmp;
proxy_cache_path /home/amproxy_cache levels=1:2 keys_zone=amproxy:20m inactive=10d max_size=2g;
tcp_nodelay on;
server_tokens off;
gzip on;
gzip_min_length1000;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/rss+xml application/xhtml+xml application/atom_xml;
gzip_disable "MSIE .(?!.*SV1)";
log_formataccess'$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" $http_x_forwarded_for';
include vhost/*.conf;
include proxy/*.conf;
server
{
listen51027;
server_name 127.0.0.1;
index index.html index.htm index.php;
root/home/wwwroot/index/web;
fastcgi_buffer_size 4k;
fastcgi_buffers 8 4k;
fastcgi_busy_buffers_size 4k;
gzip off;
location ~ .*\.php$
{
fastcgi_pass unix:/tmp/php-cgi.sock;
fastcgi_index index.php;
include fcgi.conf;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 30d;
}
location ~ .*\.(js|css)?$
{
expires 12h;
}
access_log/home/wwwroot/index/log/access.log combined;
error_log /home/wwwroot/index/log/error.log crit;
}
server
{
listen 80 default;
return 400;
}
}
我现在在防火墙里限制了连接数 不知道有效果没：
-A INPUT -p tcp -m tcp --dport 678 -m connlimit --connlimit-above 1 --connlimit-mask 32 -j DROP 求高人指点。。。又死了 查出谁D的，打死他，服务器就不会挂了 504？TXT？。。你确定你TXT不是PHP生成的？
雨宫音羽 发表于 2015-1-23 14:59
504？TXT？。。你确定你TXT不是PHP生成的？
绝对不是，自己上传的 txt 都能c挂？动用了php进程？
didiaomiss 发表于 2015-1-23 15:23
txt 都能c挂？动用了php进程？
没有啊 我那个空间php都关了 不会是wdcp的吧可以c你 探针的扔阿里OSS上去吧.
didiaomiss 发表于 2015-1-23 16:18
不会是wdcp的吧可以c你 探针的
没c探针 日志显示只c那个txt文件
amh的
页:
[1]
2