Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of emailgrant@gmail.com designates
 209.85.212.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <34f35ad7781b611ea484f0c2793a89ff@itsecuritypros.org>
References: <gf5y8qbbtet92ccxg9tfbmo5.1374965284734@email.android.com>
	<CAN0CFw2OjzLe9kZ=DY-nGqhxsAWb+g7f7mcp7a9XUeKP2wOuPQ@mail.gmail.com>
	<346c265337d1832d580bf92db427ecc7@itsecuritypros.org>
	<34362e43108806639bfc26468eaaab2a@itsecuritypros.org>
	<CAN0CFw00-cQxziGju2zwg3TJLK-bu7HiH4O=AKWrjh3HKWFSAw@mail.gmail.com>
	<34f35ad7781b611ea484f0c2793a89ff@itsecuritypros.org>
Date: Mon, 29 Jul 2013 23:25:26 -0700
Message-ID: 
 <CAN0CFw25TFud1XQXYPJOLQvL9zhoz4cV6=izqoyZ-iHND98BEg@mail.gmail.com>
From: Grant <emailgrant@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [users@httpd] Re: apache service interruption

> You wouldn't keep a syn proxy rule enabled all the time; only under a DoS
> attack.  You could also implement ModSecurity.

ModSecurity looks good and I think it works with nginx as well as
apache.  Is everyone who isn't running OSSEC HIDS or ModSecurity
vulnerable to a single client requesting too many pages and
interrupting the service?

- Grant


>>> Also, you should be able to limit simultaneous client connections with
>>> your
>>> firewall and pass the traffic in a syn proxy state. There are numerous
>>> ways
>>> to achieve this.
>>
>>
>> Is that the best way to go besides OSSEC HIDS?  I can imagine that
>> sort of thing could cause problems.
>>
>> - Grant
>>
>>
>>>> You can always compile from source ;)
>>>> What version of Apache are you running?
>>>>
>>>> On 07/29/2013 02:59 AM, Grant wrote:
>>>>>>
>>>>>>
>>>>>> Was it just an IP exhausting the apache service with too many
>>>>>> connections?  What do you see in the access logs?  I use OSSEC HIDS on
>>>>>> my
>>>>>> apache servers to mitigate this.
>>>>>
>>>>>
>>>>>
>>>>> In the access log I see the same IP made many requests during the
>>>>> service interruption and I think that exhausted the apache service.
>>>>> It looks like there isn't a Gentoo ebuild for OSSEC HIDS.  Is there
>>>>> another way to prevent this sort of thing?
>>>>>
>>>>> - Grant
>>>>>
>>>>>
>>>>>>>> My server has 4GB RAM and uses nginx as a reverse proxy to apache. A
>>>>>>>> little while ago my website became inaccessible for about 30
>>>>>>>> minutes.
>>>>>>>> I checked my munin graphs and it looks like apache processes spiked
>>>>>>>> to
>>>>>>>> about 29 during this time which is many times greater than usual. I
>>>>>>>> have MaxClients at 30 and the error log verifies that MaxClients was
>>>>>>>> not reached.  The strange part is system disk latency shows a spike
>>>>>>>> during the interruption which is only very slightly greater than
>>>>>>>> other
>>>>>>>> spikes which did not interrupt service.  System CPU, memory, and
>>>>>>>> swap
>>>>>>>> usage don't show anything interesting at all.
>>>>>>>>
>>>>>>>> Does this make sense to anyone?  Should I decrease MaxClients?
>>>>>>>>
>>>>>>>> - Grant
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> I've looked over my access_log and I can see there is a particular IP
>>>>>>> which was making many requests during the interruption.  Since munin
>>>>>>> does not show there was an excessive amount of memory or CPU usage,
>>>>>>> lowering MaxClients won't help?
>>>>>>>
>>>>>>> - Grant

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org