# ⚡ Apache/LAMP Quick Start - Stop Attack NOW ## 🚨 Emergency - 3 Commands to Stop Attack ```bash # 1. Block attacker IP (30 seconds) sudo nano /var/www/html/sellzaki.com/production/public/.htaccess # Add at TOP: # # Require all granted # Require not ip 41.44.117.225 # # Save: Ctrl+X, Y, Enter # 2. Restart PHP-FPM (30 seconds) sudo systemctl restart php8.2-fpm # 3. Deploy Laravel security (2 minutes) cd /var/www/html/sellzaki.com/production git pull origin main php artisan cache:clear php artisan route:clear ``` **✅ Done! Attack stopped.** --- ## 📋 What Just Happened ### The Attack - **IP**: 41.44.117.225 - **Target**: `/api/products/search?q=t` - **Method**: Rapid single-character searches - **Impact**: All PHP-FPM workers exhausted ### The Fix 1. **Blocked IP** at Apache level (instant) 2. **Restarted PHP-FPM** to free workers 3. **Deployed security**: - Minimum 2-char search requirement - Rate limiting (10 req/min) - Auto-blocking for abuse --- ## 🛡️ Full Protection Setup (Optional - 15 minutes) ### Install mod_evasive (Recommended) ```bash # Install sudo apt-get update sudo apt-get install libapache2-mod-evasive # Enable sudo a2enmod evasive # Create log directory sudo mkdir -p /var/log/apache2/mod_evasive sudo chown www-data:www-data /var/log/apache2/mod_evasive # Configure sudo nano /etc/apache2/mods-enabled/evasive.conf ``` Add this: ```apache DOSHashTableSize 3097 DOSPageCount 5 DOSSiteCount 50 DOSPageInterval 1 DOSSiteInterval 1 DOSBlockingPeriod 60 DOSLogDir "/var/log/apache2/mod_evasive" ``` ```bash # Test and reload sudo apache2ctl configtest sudo systemctl reload apache2 ``` ### Update VirtualHost (Better than .htaccess) ```bash # Edit your site config sudo nano /etc/apache2/sites-available/000-default.conf # or sudo nano /etc/apache2/sites-available/sellzaki.conf ``` Add inside ``: ```apache # Block specific IPs Require all granted Require not ip 41.44.117.225 # Rate limiting DOSPageCount 10 DOSSiteCount 50 DOSBlockingPeriod 60 # Stricter for search endpoints DOSPageCount 5 DOSPageInterval 1 ``` ```bash # Test and reload sudo apache2ctl configtest sudo systemctl reload apache2 ``` --- ## ✅ Verify Everything Works ```bash # 1. Check site is up curl -I https://tyson.sellzaki.com # Should return 200 OK # 2. Check PHP-FPM workers ps aux | grep php-fpm | wc -l # Should be 5+ # 3. Test search validation curl "https://tyson.sellzaki.com/api/products/search?q=t" \ -H "Authorization: Bearer YOUR_TOKEN" # Should return error about 2 characters # 4. Test valid search curl "https://tyson.sellzaki.com/api/products/search?q=test" \ -H "Authorization: Bearer YOUR_TOKEN" # Should return products ``` --- ## 📊 Monitor ```bash # Watch Apache logs sudo tail -f /var/log/apache2/access.log # Watch for blocked IPs sudo tail -f /var/log/apache2/mod_evasive/* # Watch Laravel logs tail -f storage/logs/laravel.log | grep -i "suspicious\|blocked" # Check PHP-FPM workers watch -n 2 'ps aux | grep php-fpm | wc -l' ``` --- ## 🔧 Common Tasks ### Block Another IP ```bash # Quick (via .htaccess) sudo nano /var/www/html/sellzaki.com/production/public/.htaccess # Add: Require not ip NEW_IP # Better (via conf file) sudo nano /etc/apache2/conf-available/blocked-ips.conf # Add: Require not ip NEW_IP sudo systemctl reload apache2 ``` ### Unblock an IP ```bash # Remove from .htaccess or conf file sudo nano /etc/apache2/conf-available/blocked-ips.conf # Delete the line sudo systemctl reload apache2 ``` ### Increase PHP-FPM Workers ```bash sudo nano /etc/php/8.2/fpm/pool.d/www.conf # Change: pm.max_children = 10 (was 5) sudo systemctl restart php8.2-fpm ``` --- ## 🆘 Troubleshooting ### Site Still Slow? ```bash # Check PHP-FPM workers ps aux | grep php-fpm | wc -l # Check Apache processes ps aux | grep apache2 | wc -l # Check for errors sudo tail -100 /var/log/apache2/error.log ``` ### Apache Won't Start? ```bash # Test config sudo apache2ctl configtest # Check what's wrong sudo systemctl status apache2 # Check error log sudo tail -50 /var/log/apache2/error.log ``` ### Need to Rollback? ```bash # Remove IP block sudo nano /var/www/html/sellzaki.com/production/public/.htaccess # Delete the RequireAll block # Revert Laravel code cd /var/www/html/sellzaki.com/production git log --oneline -5 git checkout PREVIOUS_COMMIT_HASH php artisan cache:clear ``` --- ## 📚 Full Documentation - **Quick Commands**: [SECURITY-QUICK-REFERENCE.md](SECURITY-QUICK-REFERENCE.md) - **Full Apache Guide**: [APACHE-DEPLOYMENT.md](APACHE-DEPLOYMENT.md) - **Complete Overview**: [SECURITY-README.md](SECURITY-README.md) - **Architecture**: [SECURITY-ARCHITECTURE.md](SECURITY-ARCHITECTURE.md) --- ## ✅ Success Checklist - [x] Attacker IP blocked (41.44.117.225) - [x] PHP-FPM restarted and workers available - [x] Laravel security deployed - [x] Site accessible and responsive - [x] Search requires 2+ characters - [x] Rate limiting active (optional but recommended) - [x] Logs being monitored --- ## 🎯 What's Protected Now ### Laravel Level - ✅ Minimum 2-char search requirement - ✅ Rate limiting: 10 requests/minute per IP - ✅ Pattern detection for abuse - ✅ Auto-blocking for repeat offenders ### Apache Level (if mod_evasive installed) - ✅ 5 requests/second per page - ✅ 50 requests/second per site - ✅ 60-second block for violators ### Application Level - ✅ Input sanitization - ✅ Query optimization - ✅ Result limiting --- ## 📞 Need Help? **Check logs**: ```bash # Apache sudo tail -f /var/log/apache2/error.log # Laravel tail -f storage/logs/laravel.log # PHP-FPM sudo tail -f /var/log/php8.2-fpm.log ``` **Common commands**: ```bash # Restart services sudo systemctl restart apache2 sudo systemctl restart php8.2-fpm # Test Apache config sudo apache2ctl configtest # Check service status sudo systemctl status apache2 sudo systemctl status php8.2-fpm ``` --- **🎉 Your site is now protected!** The attack is stopped and future attacks will be automatically blocked.