Can help prevent SYN flood DDoS attack
[Mon Nov 4 17:35:53 2019] possible SYN flooding on ctid 0, port 465. Sending cookies.
[Mon Nov 4 19:23:41 2019] possible SYN flooding on ctid 0, port 25. Sending cookies
cat > SYN_RECV.sh << "END"
#!/bin/bash
netstat -natp | grep SYN_RECV | sort | awk '{ print $5 }' | sort | cut -d ":" -f1 | uniq -c | awk '{if ($1>100) system("iptables -I INPUT -s "$2" -j REJECT")}'
END
#ANsible copy and add to cron:
ansible -i inv.txt cpa -m copy -a "src=SYN_RECV.sh dest=/root/bin/SYN_RECV.sh mode=755 owner=root group=root"
ansible -i inv cpa -m cron -a "name=SYN_BLOCK job=/root/bin/SYN_RECV.sh user=root"