Let's say I have a 5mpbs up and 50 mbps down-link. I'm running a web-server with one quite large resource (it's about 1 megabit, not byte). What is there to stop a malicious individual from running 5 instances of curl on his machine running each one through a different proxy and requesting my file to be sent to them? Would that kind of attack clog my uplink? Would that kind of attack even work?
I wouldn't qualify this is an attack per se since this is a pretty common scenario for a fileserver. If you are afraid of burning through your bandwidth, then limit the requests per address. Obviously this doesn't protect against proxies, as you mentioned. The best thing you can do is prevent direct file access via an URL, that way you control the requests.
Hosting services, Sourceforge of example, use a counter system that waits a few seconds before serving the file. You can do this to distribute requests more evenly.
If you want to go all the way, then remember the session/address/client data on the server, so you can limit the downloads per day/hour/.. Another option would be to allow downloads only when the client is in possession of a certain token.
Ofcourse, the above is all in addition to a good firewall, which is (when setup correctly) already capable of detecting false play.
There's 3 questions:
What is there to stop a malicious individual from running 5 instances of curl on his machine running each one through a different proxy and requesting my file to be sent to them?
Nothing, you can't prevent someone for doing something. The best you can do is to tweak your webserver configuration to limit the accepted requests.
Would that kind of attack clog my uplink?
Of course yes.
Would that kind of attack even work
Again, of course yes.
I would add it could even not be an attack, just a few people honnestly downloading the file (because you gave them the link for example) would achieve the exact same result, your uplink will be used à 100% until everyone has downloaded the file.
So even 1 person with a down link above 5Mb/s will use your up link at 100% while downloading the file for the time of the download (which would be roughly 0.2 second for a 1Mb file).
Now if you get 10 requests to your file, you'll have to send 10Mb of data, should use your link for approximatively 2 seconds.
Those maths are not exact timing as there's a little more TCP handshake involved and some lag possible on the internet at end, but I hope this give you an idea on why it will happen :)