Icecast Streaming Media Server

[WAB]

Hi,

I've been running icecast for 7+ years now and there are to issues I'm trying to get along with:

A. A single IP can have infinite clients, so flooding is easy.
B. Multiple requests on status.xsl (only?) can cause the same effect

So, is fail2ban a proper solution? Does anyone have a walkthrough for that. I understand tha playing around with it isn't the smartest think to do. So someone who really has a grasp on it...

[karlH]

fail2ban is fine for certain spamming cases that have been seen but are typically for 404 responses. You can rate limit on a single IP via the firewall, fail2ban is typically for DDoS cases.

karl.

[DJ-Zath]

hi there!

I, too, have noted these issues...

heres what I did to combat them:

"listeners can have an infinite number of connections"

what I did to fix this, using FreeBSD, added the following rules to ipfw:

/sbin/ipfw add 5004 pass tcp from any to me 8000 in via re0 setup limit src-addr 3
/sbin/ipfw add 5006 pass tcp from any to me 8001 in via re0 setup limit src-addr 3

and...

There's a trick to removing access to status.xsl...

just remove (or rename) the status.xsl file, you can still get status.xml through your admin login since that is built-in internally to icecast

what I have done was to remove the status.xsl file completely and set:

<paths>
<alias source="/" dest="/stream.mp3" />
<alias source="" dest="/stream.mp3" />
<paths>

and:

<fileserve>0</fileserve>

and now icecast will only serve the streams..

and that ends those 2 issues.
_________________
-DjZ-

[WAB]

I think I'll just rename status.xml... But I'm not completely sure that's enough

Anyway, I use CentOS. I'm not sure that the same think can be done via it's built-in firewall, that's why I'm digging in fail2ban.

I'll post it here if I come up with a solution. If anyone has a tip it's welcome

[DJ-Zath]

hi there

CentOS.. I think that might use iptables, and, you're right.. I don't think you can get that level of control using iptables..

I wish I could help, sorry, I don't know iptables well enough to provide any assistance in this matter.
_________________
-DjZ-

[karlH]

the iptables rules for a similar setup should be something like

iptables -I INPUT -p tcp --dport 8000 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 8000 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 -j DROP

obviously the matching criteria does not have to be on a single port and the tolerance settings can be adjusted but this serves as a simple example.

karl.

[WAB]

You think iptables and fail2ban will do the same thing?

At a glance I can't understand -m recent, "--update --seconds 60 --hitcount 8" and --set. I mean I understand what you mean, but are those iptables commands? Moreover do we have an ACCEPT default policy for 8000 in your example. If we have a DROP then I guess that we have to take care of ESTABLISHED and RELATED.

PS: I want to update from icecast 2.3.2 to 2.3.3-KH branch. Is there any way to update or shall I compile from scratch? In the latter case can I have both versions running concurrently?

[karlH]

The iptables rules are for the same IP, fail2ban is typically for repeated failures eg 404, the main one I've seen for fail2ban is a DDoS attack matching /*/index.html. Here iptables acts as a limiter for each IP whereas fail2ban tries to block new connections based on previously completed connections.

A default policy of ACCEPT is fine, the drop rule just forces the offending connection attempt to be ignored, no need to do anything for established connections, as you are only concerned about initial packets. There are no related ones in this case.

I just copied and pasted, there may be a shorter rule.

karl.

[karlH]

regarding a 2.3.x to Kh update. It may be possible to get a pre-built package from somewhere but I provide sources (and win32 builds) so you would need to compile from scratch.

you can have 2.3.x and KH installed at the same time. icecast is a single self contained program, which utilises xsl and log files for running. Obviously have 2 installations means you will need to keep the binaries separate, whether that is by using a different installation directory or just appending the version to the program name is up to you.

karl.