Solve external udp attacks in linux

In addition to disabling functions and udp packet filtering, there is no good solution to phpddos.
For windows systems, see: http://www.bkjia.com/Article/201110/107970.html


The following describes how to change the security settings of linux servers and php to prevent trojans from becoming a ddos attack source.
 
1. php. ini disables parameters such as exec in the php call system.
Add the following line to php. ini:
Disable_functions = symlink, shell_exec, exec, proc_close, proc_open, popen, system, dl, passthru, escapeshellarg, escapeshellcmd
2. Disable ouput udp packets from the server (except for the domain name resolution server set on the local machine)
#! /Bin/sh
NSIP = 'cat/etc/resolv. conf | grep nameserver | awk 'nr = 1 {print $2 }''
/Sbin/iptables-a output-p udp-j DROP
/Sbin/iptables-I OUTPUT-p udp-dport 53-d $ NSIP-j ACCEPT
For the tcp protocol, you can use the following iptables, which is provided by a friend:
Iptables-a output-p tcp -- dport 80-m state -- state NEW-j DROP