Re: Mitigating the Slowloris DoS attack

Guenter Knauf wrote: Hi Andreas, Andreas Krennmair schrieb: For those who are still unaware of the Slowloris attack, it's a denial-of-service attack that consumes Apache's resources by opening up a great number of parallel connections and slowly sending partial attack including a PoC

Re: [Fwd: Slowloris]

(moved to dev@ - as this issue is now perfectly public). Ben Laurie wrote: Dirk-Willem van Gulik wrote: Ben Laurie wrote: What does that matter? If you need to do it less to Apache, then Apache is broken in comparison to the others. Completely agreed - no need to get into a spitting match as

Apache requires read permissions for parent directories of configuration files

Hi, I encountered the following problem with Apache HTTPD on Windows: * lets suppose that server root is "C:\ABC\XYZ\root"; * httpd service have all appropriate access permissions for the server root; * but httpd service doesn't have any access permission for the parents of the root. E.g. http

Re: Mitigating the Slowloris DoS attack

Andreas Krennmair wrote: > * Guenter Knauf [2009-06-22 04:30]: >> wouldnt limiting the number of simultanous connections from one IP >> already help? F.e. something like: >> http://gpl.net.ua/modipcount/downloads.html > > Not only would this be futile against the Slowloris attack (imagine n > con

Re: Apache requires read permissions for parent directories of configuration files

Ivan Zhakov wrote: > > I encountered the following problem with Apache HTTPD on Windows: > * lets suppose that server root is "C:\ABC\XYZ\root"; > * httpd service have all appropriate access permissions > for the server root; > * but httpd service doesn't have any access permission for > the p

Re: Apache requires read permissions for parent directories of configuration files

William A. Rowe, Jr. wrote: > Ivan Zhakov wrote: > >> * is it possible to remove APR_FILEPATH_TRUENAME argument in the trunk >> of Apache HTTP Server? (see attached patch) > > -1, veto for such a change. > > Change this and httpd and even third party modules can ultimately discover > their con

build mod_proxy by source

Hi All, I need to build mod_proxy by source rather than enable in the configuration. I dont know how to build it by apxs as it has two dependent files (proxy_util.c and mod_proxy.c) .Please help me to over come this problem. Best Regards, Iroshan Under Graduate-UCSC Sri Lanka

Re: build mod_proxy by source

apxs -c -o mod_proxy.so mod_proxy.c proxy_util.c On Mon, Jun 22, 2009 at 11:00 PM, h iroshan wrote: > Hi All, > > I need to build mod_proxy by source rather than enable in the > configuration. I dont know how to build it by apxs as it has two dependent > files (proxy_util.c and mod_proxy.c) .Pl

Re: build mod_proxy by source

hi Kevac Marko, Thank you very much.

Re: build mod_proxy by source

hi Kevac Marko, apxs -c -o mod_proxy.so mod_proxy.c proxy_util.c above command not generate mod_proxy.so . Please help me Regards Iroshan

Re: [Fwd: Slowloris]

On Mon, Jun 22, 2009 at 02:23:12PM +0200, Dirk-Willem van Gulik wrote: >>> -Seriously rewrite apache/add a worker which mimics the >>> accept_filter.ko >>> of freebsd somewhat in that it as a single threaded async select() >>> loop >>> which buffers things up until they are cooked eno

Re: build mod_proxy by source

Look: $ ~/micex/opt/httpd-worker/bin/apxs -c -o mod_proxy.so mod_proxy.c proxy_util.c /home/marko/micex/opt/httpd-worker/build/libtool --silent --mode=compile gcc -prefer-pic -g -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -pthread -I/home/marko/micex/opt/httpd-worker/include -I/home/marko/micex/opt/http

Re: Mitigating the Slowloris DoS attack

Hi, How about coding a module looking how many bytes are read and if there is too little chunk of data, close the connection. Something like a MinDataReadSize. If the read() function read too little data, close() the socket... Dunno if it's possible to hook directly in connection hook to do this..

Re: Mitigating the Slowloris DoS attack

William A. Rowe, Jr. at 2009-6-23 2:00 wrote: Andreas Krennmair wrote: * Guenter Knauf [2009-06-22 04:30]: wouldnt limiting the number of simultanous connections from one IP already help? F.e. something like: http://gpl.net.ua/modipcount/downloads.html Not only would this be fu

Re: Mitigating the Slowloris DoS attack

2009/6/23 Weibin Yao : > William A. Rowe, Jr. at 2009-6-23 2:00 wrote: >> >> Andreas Krennmair wrote: >> >>> >>> * Guenter Knauf [2009-06-22 04:30]: >>> wouldnt limiting the number of simultanous connections from one IP already help? F.e. something like: http://gpl.net.ua/modip

Re: Mitigating the Slowloris DoS attack

On Sun, Jun 21, 2009 at 4:10 AM, Andreas Krennmair wrote: > Hello everyone, . > The basic principle is that the timeout for new connections is adjusted > according to the current load on the Apache instance: a load percentage is > computed in the perform_idle_server_maintenance() routine and ma

Re: Mitigating the Slowloris DoS attack

On Mon, Jun 22, 2009 at 9:07 PM, Graham Dumpleton wrote: > 2009/6/23 Weibin Yao : >> William A. Rowe, Jr. at 2009-6-23 2:00 wrote: >>> >>> Andreas Krennmair wrote: >>> * Guenter Knauf [2009-06-22 04:30]: > > wouldnt limiting the number of simultanous connections from one IP