Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of emailgrant@gmail.com
 designates 74.125.82.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20130730075303.GA1834@palma.openstrike.co.uk>
References: <gf5y8qbbtet92ccxg9tfbmo5.1374965284734@email.android.com>
	<CAN0CFw2OjzLe9kZ=DY-nGqhxsAWb+g7f7mcp7a9XUeKP2wOuPQ@mail.gmail.com>
	<346c265337d1832d580bf92db427ecc7@itsecuritypros.org>
	<34362e43108806639bfc26468eaaab2a@itsecuritypros.org>
	<CAN0CFw00-cQxziGju2zwg3TJLK-bu7HiH4O=AKWrjh3HKWFSAw@mail.gmail.com>
	<34f35ad7781b611ea484f0c2793a89ff@itsecuritypros.org>
	<CAN0CFw25TFud1XQXYPJOLQvL9zhoz4cV6=izqoyZ-iHND98BEg@mail.gmail.com>
	<20130730075303.GA1834@palma.openstrike.co.uk>
Date: Thu, 1 Aug 2013 01:31:45 -0700
Message-ID: 
 <CAN0CFw1s_KtUQmhXsSDJQsatOrsi4HQRv=b16Au6n+dWMrYcwQ@mail.gmail.com>
From: Grant <emailgrant@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [users@httpd] Re: apache service interruption

>> ModSecurity looks good and I think it works with nginx as well as
>> apache.  Is everyone who isn't running OSSEC HIDS or ModSecurity
>> vulnerable to a single client requesting too many pages and
>> interrupting the service?
>
> Not everyone, no. There are other alternatives such as mod_limitipconn
> and mod_reqtimeout to help with such problems as well.

mod_limitipconn sounded like the perfect solution until I started
thinking about how many people use the same IP address in some
environments like university campuses.  I could end up creating a lot
more problems than I solve.  Does ModSecurity have the same potential
downside?  Would mod_remoteip prevent this?

Is mod_reqtimeout a better solution?  I found the following config
recommended online within the context of Slowloris attack mitigation:

RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500

Will that do anything to prevent someone from opening too many
connections and interrupting the apache service?

- Grant

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org