0

I am the reluctant "sysadmin" of a medium-sized cooking blog that runs on a t2.small EC2 instance, and utilizes WordPress on the LAMP stack. Despite being a fairly embarrasingly bad "sysadmin" it actually runs really reliably and efficiently despite shipping a LOT of traffic. I've done everything I can but every now and then (about once a year) someone manages to hammer it with a DDOS type attack. What tends to happen is that the apache server dies and anyone request anything from the website gets a HTTP timeout. Restarting the httpd service immediately fixes the problem.

What I'm thinking of doing is scheduling a CRON job to call the website every 5ish minutes and if it finds that it gets a timeout more than twice, it restarts the httpd service and sends me an email. Now, this is NOT one of those "I can't set up my apache server properly so I'll restart it every hour" solutions. The apache is tweaked and runs beautifully when it isn't being hacked. And I've put in as much firewall anti-hacking best practice as I possibly can. My rationale is basically "hackers and crazies are always finding new ways to hammer me and when they do I'd rather have 10 minutes of outage and an email than potentially hours of downtime (if I'm asleep or away)". The question is, is this a good solution or is there a better, more sysadminny way to do this using some existing technology?

  • You just need to check if your apache is running and in case not running then you restart the web server. I think I will have a solution for you. – prosti Dec 23 '16 at 16:34
  • Not sure why this is WP related...but this really is not a solution. There are proscribed ways of handling DDOS, and AWS has a bunch of them in their arsenal. Suggest you do some more research. – C C Dec 23 '16 at 18:12
0

You need something like this:

#!/bin/bash
#test-httpd.sh
client="yourname"
mailboxes="email@address.com"
# write to that file
monitorfile="/var/www/html/monitor.php"

#empty monitor.php
> $monitorfile

APACHE=`/bin/pidof httpd`
echo $APACHE

if [ "$APACHE" == "" ]
   then
    echo APACHE_FAILURE  | mail -s "$client"": CRITICAL : APACHE FAILURE !!!!" $mailboxes
#trying to restart it
    /etc/init.d/httpd stop
    /etc/init.d/httpd start
    echo -e "apache:FAIL\n" >> $monitorfile
else
    echo -e "apache:OK\n" >> $monitorfile
fi

Lastly, you need a cron job, that will execute this script test-httpd.sh every minute.

This may be in your crontab

#check httpd
* * * * *   root    /opt/misc/test-httpd.sh  > /dev/null 2>&1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.