How to enable Enhanced DoS Protection

Issue

How to enable enhanced DOS attack protection on Imunify360 to minimize negative impact from attacks, that could be wasting CPU, memory and other system resources by creating junk load?

Environment

• Imunify360
• Any OS
• Any Panel
• DoS attack

Solution

Please note - This feature is allowed on version 7.6 for the Firewall Module. Please see the detailed description of the product changes we made in version 7.6 through our publicly available changelog for Imunify360 and How to update Imunify360.

The feature is switched off by default. You can activate Enhanced DOS Protection in Imunify360 using the following CLI command:

imunify360-agent config update '{"ENHANCED_DOS":{"enabled":true}}'

The default timeframe (seconds) and threshold of request (number) could be changed by the following CLI commands:

imunify360-agent config update '{"ENHANCED_DOS":{"timeframe":60}}'

imunify360-agent config update '{"ENHANCED_DOS":{"default_limit":500}}'

Request limits for different ports can be set separately, using the following CLI commands:

imunify360-agent config update '{"ENHANCED_DOS": {"port_limits": {"80": 150}}}'

• The attacker's IP is listed for 300 seconds.
  
• Enhanced DoS Protection watches over every port in range from 1 to 65535 (inclusive) and applies the default_value to it. Option port_limits allows you to set a custom limit for any port in the same range [1..65535].

It can also be activated and customized from the Imunify360 UI settings:

We also recommend checking and configuring the CAPTCHA_DOS section of parameters to blacklist IPs after repetitive requests to the captcha.

Useful Links

• https://blog.imunify360.com/imunify-firewall-module-v7.6-released 
• https://docs.imunify360.com/update/ 
• https://changelog.imunify.com/imunify360 
• https://docs.imunify360.com/dashboard/#enhanced-dos-protection