Ubuntu

if your working with Ubuntu in lab or test env, you may want to disable firewall…. two simple commands;

sudo ufw disable 

sudo apt-get remove ufw 

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
ufw
0 upgraded, 0 newly installed, 1 to remove and 3 not upgraded.
After this operation, 838 kB disk space will be freed.
Do you want to continue? [Y/n] Y
(Reading database ... 64052 files and directories currently installed.)
Removing ufw (0.35-0ubuntu2) ...
Skip stopping firewall: ufw (not enabled)
Processing triggers for man-db (2.7.5-1) ...

Previously to take down this wordpress site all you needed to do was hold down F5 for about 20 seconds then the site would take about 5 mins to recover.

There were a few factors causing this and quite a few different methods to solving the problem. Wordpress itself is run on php / apache, apache has an evasive mod which can block certain IPs depending on the defined abusive behavior (typical DDOS attack). Since i like to run a few websites behind a single IP i looked at fixing the issue closer to the perimeter….

Great guide here - http://www.classhelper.org/articles/reverse-proxy-server-squid-debian/installing-squid-proxy-server.shtml

I’ve modified slightly for Ubuntu, but almost identical.

apt-get install squid cp /etc/squid3/squid.conf /etc/squid3/squid.bak rm /etc/squid3/squid.conf nano /etc/squid/squid.conf

http_port 80 defaultsite=www.yoursite.com vhost forwarded_for on refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 cache_peer 192.168.0.13 parent 80 0 no-query no-digest originserver name=web1 acl sites_web1 dstdomain www.yoursite.com yoursite.com cache_peer_access web1 allow sites_web1 cache_peer 192.168.0.14 parent 80 0 no-query no-digest originserver name=web2 acl sites_web2 dstdomain www.anothersite.com anothersite.com cache_peer_access web2 allow sites_web2 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 443 # https acl Safe_ports port 1025-65535 # unregistered ports acl CONNECT method CONNECT http_access allow sites_web1 http_access allow sites_web2 http_access allow manager all http_access allow manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports #http_access deny all access_log /var/log/squid3/access.log cache_mgr [email protected]

I’m using the following crontab script to renice my squid process….

Put following in script and  call via cron (i’m doing every 10 mins)

*/10 * * * * /home/user/renice.sh

(renice.sh)

renice -15 $(ps -C squid3 -o pid=) renice -15 $(ps -C unlinkd -o pid=)

fire up the vm, then run the following after initiating a vmware tools install…

mount /dev/cdrom /mnt/cdrom cd /tmp tar zxf /mnt/cdrom/VMwareTools-x.x.x.gz cd vmware-tools-disstrib ./vmware-install.pl

Then just follow the prompts through to the end.

If your running fedora or similar make sure your’ve got gcc and kernel headers…. (you’ll probably have to update kernel too)

yum update shutdown -r now yum install -y gcc make kernel-devel perl

Ubuntu 12.x

apt-get install open-vm-tools