How to prevent Denial of Service (DoS) attacks in sharepoint

Question

Today i have facing a problem of the Denial of Service (DoS) attacks on my public facing anonymous web site.

My server return the error message as "Server is too busy, Try again later".

We have firewall as well, But we dont block the IP's coz its dynamic all over the world.

Please guide me how we can prevent this attack. Or is there any way to avoid this kind of attack from the sharepoint or from the code

Any suggestion will be appreciated.

Answer 1

Honestly, Denial of Service are better (and must be) handled at levels below SharePoint i.e. ASP.NET, IIS, OS or infrastructure levels. Being an application stack, SharePoint would have no or limited tools to prevent such attacks. Also, trying to handle it at SharePoint level would prove inefficient.

I would recommend posting the question in ASP.NET/IIS forum.

As a side note, I know some Hosting companies even offer tools/service to detect and eliminate such threats.

Answer 2

As Ashish states its not really going to be at the SharePoint level. In most situations you would put something in front of SharePoint, just like you would any other web application. There are many utilites out there but when it comes to Microsoft maybe some of the Forefront technologies may help with what you are trying to handle. http://www.microsoft.com/en-us/server-cloud/forefront/default.aspx Something else to consider is what information or services you are exposing on your public facing site. For instance are you using forms services and doing any workflows based on impersonation. If so that is a bad idea and really does open you up to programmatic types of attacks.

Answer 3

I think we can't PREVENT Denial of Service (DOS), however we can REDUCE unauthorized packages from attacker by packet filter mechanism, or IP restriction (for small attack)(http://www.iis.net/download/DynamicIPRestrictions). For large attack, You can use hardware firewall such as Juniper, Cisco, Astaro...those hardware firewall help you audit and analyze in terms of layers in the OSI model. (You can refer to this video: http://channel9.msdn.com/Blogs/matthijs/Using-the-OSI-Model-for-Securing-Your-SharePoint-2010)

If an attack aims to SQL Server through port 1433, you should consider changing default port by a specific port and then make sure your firewall allows that specfic port.

• On SQL Server 2005: http://msdn.microsoft.com/en-us/library/ms177440%28v=sql.90%29.aspx
• On SQL Server 2008: http://msdn.microsoft.com/en-us/library/ms177440%28v=sql.100%29.aspx
• On SQL Server 2012: http://msdn.microsoft.com/en-us/library/cc646023.aspx

I don't kinda believe software firewall, but if because of limited budget, you can consider some software products like Astaro, Forefront....

One thing you can implement to reduce DOS package is to build failover clustering functionality for web application, or NLB with DFS/DFS-R as well.

In a nutshell, there are many ways to REDUCE Dos but you have to have basic understanding of system mechanism, as well as skills of hacking/security prior to making your SharePoint more safely.

T.s