Requirements: There is a small activity on the colleague's website, there is an order interface that has been frequently called 50,000 times, and 99% of them are unpaid orders, and someone maliciously requests the interface through the program. The website does not have some traffic throttling rules and security policies, and the temporary solution can only be to blacklist the requester's IP and refuse to provide services to malicious requesters.
The website uses a cloud server, and the request reaches the IIS site directly, and there is no intermediate layer such as load balancing, so IIS can directly obtain the user's IP address.
The IP address of the requester is recorded for each order placed on the website, so it is very easy to filter out the IP address of the attacker through the database group by.
If the requester's IP address is not recorded and the request is made concurrently, you can refer to the following:
How do I ban an IP address?
1. Some IPs can be prohibited from accessing through the inbound rules of the firewall, since the Windows system does not have the firewall on,Since it is not turned on, don't turn it onotherwiseIt may affect the normal operation of existing programs on the server。
2. Log in to the official ECS background and passSecurity groups prohibit IP access。
3. Use IIS's IP and domain restrictions to set up IP blacklists, the tutorial is as follows:
Log in to the server -> Open Server Manager -> Add roles and functions -> WEB server -> Security -> IP and domain restrictions, check and click Next to install, as shown in the figure below:
Open IIS Manager, find the website, and select IP and domain restrictions on the right, as shown in the image below:
Now test how the website is before adding the IP to the blacklistNormal access is possible, as shown below:
Add my native extranet IP to the IIS deny entry as shown in the image below:
Visit the site again in your native browser and find a 403 error as shown in the image below:
403 - Access Prohibited: Access denied.
You are not authorized to view this directory or pages using the credentials provided.
|
Posted on 3/6/2022 10:36:44 AM
|
|
|
|
