3

I’m looking for a solution to mitigate DoS attacks, specifically the slow rate DoS attack variant known as Slowloris, adapted for HTTP/2:

In this attack, after establishing the connection, the client sends the Connection Preface (which initiates the HTTP/2 communication). After that, the server keeps waiting for a request (GET or POST) that is never sent by the client, keeping the resource busy.

I’ve tried the following approaches with Apache2, but none worked for this scenario:

  • mod_reqtimeout: Did not work in my tests with HTTP/2.
  • ModSecurity: The module does not detect the attack since it only works with fully-formed requests. The attack occurs before the request is sent.
  • mod_http2: The H2StreamTimeout configuration didn’t help because the attack happens before the HEADER frame is sent. This setting applies only to active HTTP/2 streams.
  • mod_qos: While it limits connection increases with QS_SrvMaxConnPerIP, it doesn’t effectively block the client. I need the attacker to be blocked once the described attack characteristics are detected.

Infrastructure: pfSense + HAProxy (load balancer), Apache2 with ModSecurity and mod_qos. Limitation: I cannot implement a reverse proxy at the moment.

I believe a solution like implementing an IDS/IPS with pfSense might be effective, but I’m not sure if it’s the best approach. I’m new to defensive security and finding it difficult to determine the best path to handle this type of attack.

Can anyone suggest a tool, configuration, or any other solution to mitigate this attack within the described environment?

Thank you in advance for your help!

Improve this question
New contributor
Jackson Castilho is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

1 Answer 1

Reset to default
1

Some Apache modules still might work, but you need to target HTTP/2 at the connection level.

I assume you’ve already tried:

Timeout 5

Which applies to all connections and makes sure Apache doesn’t hold connections indefinitely waiting for the first request.

But then there’s these HTTP/2 specific rate limits:

H2MinWorkers 10
H2MaxWorkers 50
H2StreamMaxMemSize 512

These directives help reduce the impact of resource starvation caused by idle streams.

The exact timeout times/amounts here are only estimates for a relatively small server, so you can adjust them as needed.

Improve this answer
1
  • Thank you security_paranoid for your suggestions! My current problem and focus are related to the increase in connections. I use the Timeout configuration, which works very well, but I’m looking for something that allows me to create a rule, for example. This is one of the reasons I mentioned using an IDS/IPS. I say this because, in addition to this Slowloris variant, there are others, slightly simpler but equally effective.
    – Jackson Castilho
    Commented yesterday

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .