25. Denial of Service Attacks and Solutions

A denial of service attack is an attack in which one user takes up so much of a shared resource that none of the resource is left for other users. Denial of service attacks compromise the availability of the resources. Those resources can be processes, disk space, percentage of CPU , printer paper, modems, or the time of a harried system administrator. The result is degradation or loss of service.

UNIX provides few types of protection against accidental or intentional denial of service attacks. Most versions of UNIX allow you to limit the maximum number of files or processes that a user is allowed. Some versions also let you place limits on the amount of disk space consumed by any single UID (account). But compared with other operating systems, UNIX is downright primitive in its mechanisms for preventing denial of service attacks.

This is a short chapter because, as Ritchie noted, it is usually easy to determine who is responsible for a denial of service attack and to take appropriate actions.

There are two types of denial of service attacks. The first type of attack attempts to damage or destroy resources so you can't use them. Examples range from causing a disk crash that halts your system to deleting critical commands like cc and ls.

The second type of attack overloads some system service or exhausts some resource (either deliberately by an attacker, or accidentally as the result of a user's mistake), thus preventing others from using that service. This simplest type of overload involves filling up a disk partition so users and system programs can't create new files. The "bacteria" discussed in Chapter 11, Protecting Against Programmed Threats , perform this kind of attack.

Many denial of service problems in this second category result from user error or runaway programs rather than explicit attacks. For example, one common cause is typographical errors in programs, or reversed conditions, such as using the statement x==0 when you really meant to type x!=0.