We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options.
mod_reqtimeout module looks promising and we are considering enabling it, but not everything is clear about it at the moment:
minRatesettings are considered best practices and what things should we take into account when choosing the values?
- can enabling
mod_reqtimeoutpotentially impact web applications running on this web server? And, if yes, what possible problems should we expect?