Fork-bomb detection

Pat · 2014-02-19 08:02:33

I run a server that I use when I give a "intro to bash" workshop at my school

I allow a guest user to login; but a "smart" user, or one aware of fork-bombing could easily detonate one on my server. I have the limits for the guest user pretty tight, so they really cant any damage.

I was just wondering if there was a way to actually detect a fork-bomb detonation?

Rexilion · 2014-02-19 10:38:49

The problem with fork bombs is that they look a like a genuine program creating a lot of subprocesses.

Maybe install the auditd daemon?

ivoarch · 2014-02-19 10:57:28

Try limit the number of processes.

http://linuxmafia.com/faq/VALinux-kb/pr … -user.html
https://wiki.archlinux.org/index.php/Re … management

$> cat /etc/security/limits.conf
*                hard    nproc           1000

Last edited by ivoarch (2014-02-19 10:59:39)

brebs · 2014-02-19 11:07:40

Malware wiki links to a (very old) kernel patch.

Add any useful info to Arch wiki

Pat · 2014-02-19 16:29:55

ivoarch wrote:

Try limit the number of processes.
http://linuxmafia.com/faq/VALinux-kb/pr … -user.html
https://wiki.archlinux.org/index.php/Re … management
$> cat /etc/security/limits.conf
*                hard    nproc           1000

Yeah I know how to protect against it, but it would be nice if i could somehow detect when its going on.

If there was some kind of tool that could moniter the rate of new proc's by a user, and if its above a certain threshold, then we know its some kind of bad program or a bomb

Google is no help tho

t0m5k1 · 2014-02-19 20:07:06

from malware wiki:

Another solution, not widely practised, involves the detection of fork bombs by the operating system. The Linux kernel module called rexFBD[5] implements this strategy.

[5] = http://rexgrep.tripod.com/rexfbdmain.htm

Arch Linux

#1 2014-02-19 08:02:33

Fork-bomb detection

#2 2014-02-19 10:38:49

Re: Fork-bomb detection

#3 2014-02-19 10:57:28

Re: Fork-bomb detection

#4 2014-02-19 11:07:40

Re: Fork-bomb detection

#5 2014-02-19 16:29:55

Re: Fork-bomb detection

#6 2014-02-19 20:07:06

Re: Fork-bomb detection

Board footer