3

We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options.

mod_reqtimeout module looks promising and we are considering enabling it, but not everything is clear about it at the moment:

  • what header, body and minRate settings are considered best practices and what things should we take into account when choosing the values?
  • can enabling mod_reqtimeout potentially impact web applications running on this web server? And, if yes, what possible problems should we expect?
  • 1
    My comment is not about mod_reqtimeout but its about mitigation against slow HTTP DoS Attacks. Mitigation of HTTP DoS attacks are highly dependent on your setup so its better to decide the values by yourself. There are two tools which may help you in a way that you can test your server and web apps in order to mitigate the attack vectors; the first one is from OWASP Top 10 project, OWASP Switchblade 4.0, and the second one is Sergey Shekyan' slowhttptester (blog.qualys.com/securitylabs/2011/08/25/…). – JackSparrow Dec 15 '17 at 18:39
1
+50

what header, body and minRate settings are considered best practices and what things should we take into account when choosing the values?

This is heavily dependent on the normal use case for your website. You should profile your site and tune to avoid false positives. If you are just hosting small static http content you can safely set these fairly low. If you return large content, have slow servers, have client side code which pump data into a connection as it generates it or expect users on poor connections you need to set the limits in a way to allow for this.

can enabling mod_reqtimeout potentially impact web applications running on this web server? And, if yes, what possible problems should we expect?

Yes. If a connection fails to meet the restrictions it will be cut and a 408 REQUEST TIME OUT error will be returned. If you set your limits too low this will happen regularly. I would also assume this will happen to a normal user at some point no matter how loosely you set the restrictions. Ideally your application should be able to recover from it (i.e. resend the request or gracefully notify the user there are connection issues).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.