Preventing Bash Fork Bombs in Linux

Introduction

Bash Fork Bomb is a type of denial of service (DoS) attack that can crash or freeze a Linux system by overwhelming its resources. attack uses a malicious script that creates a large number of child processes, causing system to run out of available resources, such as memory or CPU time. These child processes then spawn more child processes, and cycle continues until system is unable to respond.

Preventing Bash Fork Bombs in Linux is essential for system administrators to ensure stability and availability of their systems. In this article, we will explore what a Bash Fork Bomb is, how it works, and some methods to prevent it.

What is a Bash Fork Bomb?

A Bash Fork Bomb is a type of denial-of-service (DoS) attack that exploits fork() system call in Linux. Fork() is used to create a new process by duplicating calling process. A Bash Fork Bomb is created by a malicious script that recursively calls itself, creating a large number of child processes. child processes then call themselves, and cycle continues, creating an exponential growth of processes until system crashes or freezes.

Here's an example of a Bash Fork Bomb −

:(){ :|:& };:

This is a one-liner command that recursively calls a function named ":". function pipes its output to another call of same function, and ampersand (&) sends process to background. This creates a child process that is then duplicated and creates another child process, and cycle continues until system crashes or freezes.

How does a Bash Fork Bomb Work?

A Bash Fork Bomb works by recursively calling a function that creates child processes. Each child process creates more child processes, and cycle continues until system runs out of available resources. When a new process is created using fork(), it duplicates parent process, including its memory and file descriptors. new process is then independent of parent process and can execute its own code. This allows Bash Fork Bomb to create an exponential growth of child processes, overwhelming system's resources.

Preventing Bash Fork Bombs in Linux

There are several methods to prevent Bash Fork Bombs in Linux. These methods involve limiting number of processes, setting resource limits, and configuring system settings.

• Limit number of processes − One way to prevent Bash Fork Bombs is to limit number of processes that can be created. This can be done by setting a maximum number of processes that can be created per user or system-wide. maximum number of processes can be set using ulimit command.

To set a maximum number of processes for a user, use following command −

ulimit -u <number_of_processes>

To set a maximum number of processes system-wide, edit /etc/security/limits.conf file and add following lines −

* hard nproc <number_of_processes>
* soft nproc <number_of_processes>

• Set resource limits − Another way to prevent Bash Fork Bombs is to set resource limits for processes. Resource limits define maximum amount of resources that a process can use, such as CPU time, memory, and disk space. These limits can be set using ulimit command or by editing /etc/security/limits.conf file.

To set a maximum amount of CPU time for a process, use following command −

ulimit -t <seconds>

To set a maximum amount of memory for a process, use following command −

ulimit -m <megabytes>

To set a maximum amount of disk space for a process, use following command −

ulimit -f <kilobytes>

To set resource limits system-wide, edit /etc/security/limits.conf file and add following lines −

* hard cpu <seconds>
* soft cpu <seconds>
* hard rss <megabytes>
* soft rss <megabytes>
* hard fsize <kilobytes>
* soft fsize <kilobytes>

• Configure system settings − Linux has several system settings that can be configured to prevent Bash Fork Bombs. These settings include setting a maximum number of processes, maximum amount of memory, and maximum amount of CPU time that can be used by all processes.

To set a maximum number of processes system-wide, edit /etc/sysctl.conf file and add following line −

kernel.pid_max = <number_of_processes>

To set a maximum amount of memory system-wide, edit /etc/sysctl.conf file and add following line −

vm.max_map_count = <megabytes>

To set a maximum amount of CPU time system-wide, edit /etc/security/limits.conf file and add following line −

* hard cpu <seconds>

Additional Methods for Preventing Bash Fork Bombs in Linux

• Use Process Accounting − Process accounting is a Linux feature that tracks system resources used by each process. By using process accounting, system administrators can monitor and limit resources used by each process, which can help prevent Bash Fork Bombs.

To enable process accounting, use following command −

sudo apt-get install acct

Once installed, process accounting can be enabled by adding following line to /etc/default/acct file −

ENABLE_ACCT=1

• Use cgroups − Control Groups (cgroups) is a Linux feature that allows system administrator to limit resources used by processes. Cgroups provide a more fine-grained approach to resource management than methods described above. By using cgroups, system administrators can set limits on CPU usage, memory usage, and other system resources.

To use cgroups, install cgroup-tools package using following command −

sudo apt-get install cgroup-tools

Once installed, cgroups can be configured by creating a configuration file in /etc/cgconfig.d directory. For example, to limit CPU usage of all processes in user group "webapps" to 50%, create a configuration file named "webapps.conf" with following content −

group webapps {
   cpu {
      cpu.shares = 512;
   }
}

• Use a process supervisor − A process supervisor is a program that manages and monitors execution of other programs. By using a process supervisor, system administrators can limit number of processes that can be created and monitor resource usage of each process. Some popular process supervisors for Linux include systemd, Upstart, and supervisord.

Conclusion

Bash Fork Bombs are a serious threat to stability and availability of Linux systems. Preventing Bash Fork Bombs in Linux is essential for system administrators to ensure smooth operation of their systems. Limiting number of processes, setting resource limits, and configuring system settings are some methods to prevent Bash Fork Bombs. By implementing these methods, system administrators can protect their systems from this type of denial-of-service attack.