Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (herse.apache.org: local policy)
Date: Thu, 21 Jun 2007 14:26:35 +0100
From: "Luis Moreira (ESI-GSQP)" <luis.moreira@esi.pt>
In-reply-to: <467A7336.2060708@theseamans.net>
To: users@httpd.apache.org
Message-id: <00ed01c7b407$ca45a0c0$5ed0e240$%moreira@esi.pt>
MIME-version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-language: pt
Content-transfer-encoding: quoted-printable
Thread-index: Ace0A/TmB3NkeaPkQgGm5CeNBFEiLgAATRsw
References: <467A7336.2060708@theseamans.net>
Subject: RE: [users@httpd] limiting connections per ip address in apache2
	whenunder attack

This is not an "Apache answer", but it may help you.

Do the IPs vary too much, or can you set up a firewall rule to block
incoming requests (any requests) from those IP ?
Sort of your own very personal "black list"?
Of course, should that address decide to post a legitimate request, it =
would
get blocked but hey, who told them to mess up the first time?

On the other hand, on http://www.dnsstuff.com/ you can find info on IP
addresses on the net.
Who and were they are, if they belong to spam lists, etc


May the farce be with you


Luis


-----Original Message-----
From: graham [mailto:graham@theseamans.net]=20
Sent: quinta-feira, 21 de Junho de 2007 13:47
To: users@httpd.apache.org
Subject: [users@httpd] limiting connections per ip address in apache2
whenunder attack

Hi,

I've just become involved with a system running apache2.0.55 on ubuntu=20
with linux 2.6.17.

The system is currently unable to run due to repeated downloads of a=20
large number of pdfs by systems located in China. These are hogging all=20
sockets and eventually causing apache to die (I'm appending more details =

below in case I've got the wrong end of the stick). The ip address of=20
these systems varies; they are not a single block, although they are=20
obviously working together (different ip addresses will ask for=20
sequentially related pdfs). Each ip address will request multiple files=20
in parallel.

I'm told that the limit_ipconn module would solve my problem by limiting =

the simultaneous accesses from any one ip address. There is no version=20
of this available for apache2 on ubuntu. I'm wondering if this is=20
because similar abilities have been built into apache2 itself, but=20
haven't managed to find any.

Does anyone have any suggestions?

Thanks
Graham
-----------------------------------------------
Notes from log:

The system is running ok, not at particularly heavy load (<1.0), and=20
apache is apparently running ok and not reporting errors [corrected =
later].

Tailing the apache log file shows that the only accesses to the system=20
are GETs of pdfs from two chinese systems, 218.4.152.91 and=20
222.218.254.221, which are obviously running the same software.

These systems are trying to systematically work their way through=20
downloading all chinese pdfs. When a pdf is too large and the download=20
times out, they immediately try again (at any one moment each system is=20
trying to download 3 or 4 pdfs).

If I restart apache, I immediately get accesses from all over the place, =

including the 2 chinese systems. Eventually the Chinese accesses capture =

all the apache processes, and nothing else can get access.

'Solution' found for this: turn apache off for a few minutes. The=20
chinese systems went away, and all was fine again.

One hour later =B6

The chinese systems, and the problems, returned. A little more data this =

time.

Once the chinese systems are established, netstat shows that they occupy =

most sockets but are mostly in CLOSE_WAIT state. All other requests are=20
stuck in SYNC_RECV.

After this continues for a while the apache processes gradually start to =

die off with the following sequence:

alert] (11): setuid: unable to change to uid: 33 (33 is www-data)

[alert] Child 691 returned a Fatal error... Apache is exiting!

[emerg] (43): couldn't grab the accept mutex

semop: Invalid argument


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server =
Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org