Bug#919316: bugs.debian.org: DoS with libravatar.cgi and version.cgi

2019-01-15 Thread Don Armstrong
On Tue, 15 Jan 2019, Julien Cristau wrote: > On Mon, Jan 14, 2019 at 21:27:31 -0800, Don Armstrong wrote: > > Is there any reason why we're using RLimitNPROC instead of setting > > MaxClients? > > > MaxRequestWorkers (new name for MaxClients) is set to 150 currently. We > could try lowering that

Bug#919316: bugs.debian.org: DoS with libravatar.cgi and version.cgi

2019-01-15 Thread Julien Cristau
On Mon, Jan 14, 2019 at 21:27:31 -0800, Don Armstrong wrote: > On Mon, 14 Jan 2019, Julien Cristau wrote: > > the last few days our two bugs web hosts have been struggling. We've > > got apache set up with RLimitNPROC 256, which means once www-data has > > that many processes fork() dies with

Bug#919316: bugs.debian.org: DoS with libravatar.cgi and version.cgi

2019-01-14 Thread Don Armstrong
On Mon, 14 Jan 2019, Julien Cristau wrote: > the last few days our two bugs web hosts have been struggling. We've > got apache set up with RLimitNPROC 256, which means once www-data has > that many processes fork() dies with EAGAIN. > > In the case of version.cgi that means perl forking to run

Bug#919316: bugs.debian.org: DoS with libravatar.cgi and version.cgi

2019-01-14 Thread Julien Cristau
Package: bugs.debian.org Severity: important X-Debbugs-Cc: debian-ad...@lists.debian.org Hi, the last few days our two bugs web hosts have been struggling. We've got apache set up with RLimitNPROC 256, which means once www-data has that many processes fork() dies with EAGAIN. In the case of