Nginx: mod-security rule for http slow DoS attack

Question

The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only. Is there a rule for Nginx?

Answer 1

To my knowledge, NGINX does not include anything like to describe, but we can implement our own. As I understand Apache 2 modsecurity_crs_11_slow_dos_protection, limits the number of connections. modsecurity_crs_11_slow_dos_protection

NGINX has a webpage, Mitigating DDoS Attacks with NGINX and NGINX Plus which mentions several methods for DDoS. Three ideas from their website come to mind:

Limiting the Rate of Requests

You can limit the rate at which NGINX and NGINX Plus accept incoming requests to a value typical for real users. For example, you might decide that a real user accessing a login page can only make a request every 2 seconds. You can configure NGINX and NGINX Plus to allow a single client IP address to attempt to login only every 2 seconds (equivalent to 30 requests per minute):

limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;

server {
    # ...
    location /login.html {
        limit_req zone=one;
    # ...
    }
}

The limit_req_zone directive configures a shared memory zone called one to store the state of requests for the specified key, in this case the client IP address ($binary_remote_addr). The limit_req directive in the location block for /login.html references the shared memory zone.

Limiting the Number of Connections

You can limit the number of connections that can be opened by a single client IP address, again to a value appropriate for real users. For example, you can allow each client IP address to open no more than 10 connections to the /store area of your website:

limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    # ...
    location /store/ {
        limit_conn addr 10;
        # ...
    }
}

The limit_conn_zone directive configures a shared memory zone called addr to store requests for the specified key, in this case (as in the previous example) the client IP address, $binary_remote_addr. The limit_conn directive in the location block for /store references the shared memory zone and sets a maximum of 10 connections from each client IP address.

Closing Slow Connections

You can close connections that are writing data too infrequently, which can represent an attempt to keep connections open as long as possible (thus reducing the server’s ability to accept new connections). Slowloris is an example of this type of attack. The client_body_timeout directive controls how long NGINX waits between writes of the client body, and the client_header_timeout directive controls how long NGINX waits between writes of client headers. The default for both directives is 60 seconds. This example configures NGINX to wait no more than 5 seconds between writes from the client for either headers or body:

server {
    client_body_timeout 5s;
    client_header_timeout 5s;
    # ...
}

Notice we only 'slow' connections for a DDoS, while DoS we need to mitigate by closing (or refusing) connections we deem malicious. Keep in mind the attack mitigations mentioned above are application layer DDoS mitigation. So, resources (CPU and Memory) are still be used. See, encapsulation and IP suite (TCP/IP) regarding resource usage, as resources are needed to encapsulate and de-encapsulate (frame -> packet (or datagram) -> segment -> PDU).