Ongoing DDoS Attack on Arch Linux and Quick Solutions

1. Introduction#

Arch Linux has been facing a Distributed Denial of Service (DDoS) attack since August 12, 2025. As a result of this attack, Arch Linux's main website, Arch User Repository (AUR), and forums are experiencing serious access problems.

This blog post aims to summarize the situation for Turkish Arch users and offer alternative solutions against the outage.

Arch linux repositories are unreachable from 8:00 AM Turkish time. Don't worry, it will be fixed.
byu/dolorisback inKanunsuzlar

2. Main Content#

2.1 Scope of the Attack and What the Project Team is Doing#

• Attack Details: The DDoS attack, ongoing since August 12, is severely damaging Arch Linux's main website, AUR, and forums. (SecurityWeek, Tom's Hardware, Arch Linux)
• Response and Strategy: Developers are working closely with the hosting provider. They are also evaluating services that can provide DDoS protection for long-term solutions.
• Update Source: The project has started keeping its service status page active for regular information sharing.

2.2 Alternative Access Methods for Users#

• Website Access:

• If access to the mirror list endpoint used by tools like reflector is cut off, mirrors located in the pacman-mirrorlist package should be used.

• I do not recommend using Reflector. Instead, Use Ghost Mirror

Comment
byu/dolorisback from discussion
inKanunsuzlar

• Installation ISOs can be downloaded from alternative mirrors. It is important to verify integrity and signature before downloading (e.g., 0x54449A5C).

• AUR Access:

• When AUR package access is not possible, packages can be manually cloned from the official AUR mirror repository on GitHub:

    git clone --branch <package_name> --single-branch https://github.com/archlinux/aur.git <package_name>

• After cloning the packages, you can perform the installation with the makepkg -si command.

• Wiki Access:

• For those who cannot reach Wiki pages, mirrors like arch-wiki-docs and arch-wiki-lite can be used.

2.3 Technical Details and Privacy Policy#

• During initial connection requests, connections may be rejected at first due to TCP SYN authentication; however, persistent attempts usually work.
• Technical details and the source of the attack are kept confidential as long as the attack continues.

3. Conclusion and Summary#

Although the current situation faced by Arch Linux users is frustrating, thanks to the active intervention of the development team and the temporary solutions provided, you can meet your basic needs.

AUR clones for AUR access, and mirrors for ISOs and packages are still accessible. Also, do not neglect security signature verification during all operations.

• You can follow Arch Linux server statuses here.