apache DOS workaround ?

Hi,

With a Timeout of 300 and a maxclient of 150, a client (machine) can
block an apache server from responding by establishing 150 connexions to
the server and sending a packet to each connexions every 300 seconds (by
example another line of a request header).

If you send a packet every 300 seconds, the connection remains active
forever (until the apache restart).

This means that with 150 packets every 5 minutes, in such a
configuration, you can make a denial of service on the apache server.

lowering the timeout helps, but doesn't prevent the problem. it will
just nedd a little more paquets.

is there a way, to prevent such things to happen, to limit the time
taken by a non-keepalive connection ?

--
Sebastien

Sebastien BLAISOT wrote:

> With a Timeout of 300 and a maxclient of 150, a client (machine) can
> block an apache server from responding by establishing 150 connexions to
> the server and sending a packet to each connexions every 300 seconds (by
> example another line of a request header).

Change your timeout to 15 and leave your max client as is.

This type of attack is very rare, and is not effective, at all.

Apache will spawn children as needed, and continue to serve just fine.
Your resource usage may increase some, but not so much to cause
a problem, unless you are running a very old machine with maybe
just 16 megabytes of RAM.

There is a module, mod_throttle which addresses this. However, this
module is not designed for newer 2.x versions, least last time I checked.
This module is resource intense and will inflict a serious performance
hit for busy servers. For a small casual server, works very good!

You are worrying for nothing. Relax, what you describe is not a major problem.

Purl Gurl