You should be running the rate limiter already. But note every legitimate request is also limited, not just jorgee. I find anything less than 10 requests a second visually (as in interpreted by a human) slows down how the page loads. 

Say you run htperf on your server. I don't recall my exact number, but I think I could handle say 1000 requests per second. When I ran htperf from the best pipe (internet connection) I could find, it was more like 150 requests per second. Take what you consider to be a large load on your server, say 15 simultaneous users for my dinky hobby websites. That suggests 10 requests per second to dole out the server resources across all the users. 

You can Google so-called ddos mitigation techniques for nginx that goes further into limiting. I doubt they would repel a real ddos attack, but might limit the effect of some pesky scraper on your server. 

There is a command line version of the ookla speed test. This will allow you to determine your best case bandwidth. I settled on 4mbps. My recollection is nginx uses bytes, so 500k bytes per second.
Sent: July 24, 2017 5:12 AM
Subject: Re: How to rate-limit jorgee malware scanner?

Hi!

Nginx carries with the limit_req_module. I think it is a good helper.



On 24 July 2017 at 20:10:05, Gary Sellani ([email protected]) wrote:

I just detect the use agent and return 444, but every attempt to get a file will show up in your access.log.

https://www.buildersociety.com/threads/block-unwanted-bots-on-apache-nginx-constantly-updated.1898/

I get two or three jorgee "sessions" a day. They tend not to use the domain name but reference your server by IP, so there might be some better blocking scheme.

  Original Message  
From: [email protected]
Sent: July 24, 2017 3:14 AM
To: [email protected]
Reply-to: [email protected]
Subject: How to rate-limit jorgee malware scanner?

Hi,

The Jorgee malware scanner is creating a lot of activity on my site. I
would like to rate-limit its connections to nginx based on the
User-Agent, since blocking all IP addresses with iptables seems
impossible. Is their a quick way of doing this ?

Thank you in advance ,

E

--
Etienne Robillard
[email protected]
http://www.isotopesoftware.ca/

_______________________________________________
nginx mailing list
[email protected]
http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
[email protected]
http://mailman.nginx.org/mailman/listinfo/nginx

_______________________________________________
nginx mailing list
[email protected]
http://mailman.nginx.org/mailman/listinfo/nginx

Reply via email to