Icecast Streaming Media Server

[epe]

Hi, today my monitoring service started to alert of icecast going down.

ok, it is very unusual, I simply started the service again. I thought it was the system was swapping a lot, and tweaked the http server here and there to reduce the children spawning.

however, an hour later, I got the same alert.. icecast down.. weird.

Checking the logs, I get this:

x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0
x.y.z.247 - - [26/Aug/2006:23:14:42 -0500] "GET /someradio HTTP/1.0" 404
106 "-" "WinampMPEG/2.00" 0

thousand of times. Fortunately the attack came from 3 IPs, so I blocked them on the firewall. However, I expect the attacker to realize it is being ineffective and change the IP and start over again.

Do you have any suggestion of how to mitigate the attack?

My guess: To throttle via iptables new connections to one or three per second. But I guess it will affect the other customers trying to legally access other radios.

I guess icecast should implement some sort of IP counting and avoid attacks like this.

But in the mean time, any suggestion is more than welcome.

thanks!
ernesto
_________________
--
http://www.NuestroServer.com
USA: +1 305 359 4495, España: +34 911 877 602
Ecuador: +593 2 600 4454
Se habla español

[epe]

ok, these two iptables rules helped me a lot... I even tested them, they block any IP trying to make more than 3 NEW connection attemps in 30 seconds.

iptables -I INPUT -p tcp --dport 8000 -i eth0 -m state --state NEW -m recent \
--set

iptables -I INPUT -p tcp --dport 8000 -i eth0 -m state --state NEW -m recent \
--update --seconds 30 --hitcount 3 -j DROP

I guess there should be more elaborated ways to doit, but I least I can go now and get a sleep.
_________________
--
http://www.NuestroServer.com
USA: +1 305 359 4495, España: +34 911 877 602
Ecuador: +593 2 600 4454
Se habla español

[karlH]

I'm testing out a banned IP filter list mechanism. Using iptables works but then not everyone has access to that.

karl.

[liteFun]

IP-ban would be nice for Icecast2.