Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Today i have facing a problem of the Denial of Service (DoS) attacks on my public facing anonymous web site.

My server return the error message as "Server is too busy, Try again later".

We have firewall as well, But we dont block the IP's coz its dynamic all over the world.

Please guide me how we can prevent this attack. Or is there any way to avoid this kind of attack from the sharepoint or from the code

Any suggestion will be appreciated.

share|improve this question
    
Now my observational is below. When i investigate the request through the Worker process...I identify the huge no of page request comes for various pages. And thats the reason my w3wp.exe service utilise the 99% CPU. Also the sharepoint has the threshhold. If w3wp.exe process goes up to that limit then server returns the error "Server is too busy, Try again later." Now we put the offline HTML file to the root directory of my site then w3wp.exe release the CPU utilisation –  Dilip Nikam May 9 '12 at 5:35
    
Now i am thinking to develop the similar thing in the .net where we will create some HTML page & costume HTTP handler which will redirect user to that HTML page. Where user has to click on the continue link manually and then request will come to our sharepoint site. –  Dilip Nikam May 9 '12 at 5:40
    
I am assuming the every request which will comes from the attacker will redirected to the HTML and end stay on the page will not redirected to sharepoint site. Only the genuine user will click on the Continue link and redirected to SharePoint site. This way we can reduce the process of w3wp.exe and our site will be live. Please advice me is this correct thinking or wrong.... Thanks in advance .... –  Dilip Nikam May 9 '12 at 5:40
add comment

3 Answers

Honestly, Denial of Service are better (and must be) handled at levels below SharePoint i.e. ASP.NET, IIS, OS or infrastructure levels. Being an application stack, SharePoint would have no or limited tools to prevent such attacks. Also, trying to handle it at SharePoint level would prove inefficient.

I would recommend posting the question in ASP.NET/IIS forum.

As a side note, I know some Hosting companies even offer tools/service to detect and eliminate such threats.

share|improve this answer
add comment

As Ashish states its not really going to be at the SharePoint level. In most situations you would put something in front of SharePoint, just like you would any other web application. There are many utilites out there but when it comes to Microsoft maybe some of the Forefront technologies may help with what you are trying to handle. http://www.microsoft.com/en-us/server-cloud/forefront/default.aspx Something else to consider is what information or services you are exposing on your public facing site. For instance are you using forms services and doing any workflows based on impersonation. If so that is a bad idea and really does open you up to programmatic types of attacks.

share|improve this answer
    
Thanks for replying quickly..... –  Dilip Nikam May 9 '12 at 5:02
add comment

I think we can't PREVENT Denial of Service (DOS), however we can REDUCE unauthorized packages from attacker by packet filter mechanism, or IP restriction (for small attack)(http://www.iis.net/download/DynamicIPRestrictions). For large attack, You can use hardware firewall such as Juniper, Cisco, Astaro...those hardware firewall help you audit and analyze in terms of layers in the OSI model. (You can refer to this video: http://channel9.msdn.com/Blogs/matthijs/Using-the-OSI-Model-for-Securing-Your-SharePoint-2010)

If an attack aims to SQL Server through port 1433, you should consider changing default port by a specific port and then make sure your firewall allows that specfic port.

I don't kinda believe software firewall, but if because of limited budget, you can consider some software products like Astaro, Forefront....

One thing you can implement to reduce DOS package is to build failover clustering functionality for web application, or NLB with DFS/DFS-R as well.

In a nutshell, there are many ways to REDUCE Dos but you have to have basic understanding of system mechanism, as well as skills of hacking/security prior to making your SharePoint more safely.

T.s

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.