[PHP] avoid Denial of Service

2009-10-08 Thread Gerardo Benitez
Hi everybody!


I want to get some tips about how avoid a attack of Denial of service.  May
be somebody can about your experience with Php o some configuration of
apache, o other software that help in these case.


Thanks in advance.


-- 
Gerardo Benitez


Re: [PHP] avoid Denial of Service

2009-10-08 Thread Gaurav Kumar
Not sure what exactly you are looking for.

Anyways, some common practice are request for API key, username / password
tokens before providing access to a service.

Thanks,

Gaurav Kumar


On Thu, Oct 8, 2009 at 7:06 PM, Gerardo Benitez gerardobeni...@gmail.comwrote:

 Hi everybody!


 I want to get some tips about how avoid a attack of Denial of service.  May
 be somebody can about your experience with Php o some configuration of
 apache, o other software that help in these case.


 Thanks in advance.


 --
 Gerardo Benitez



Re: [PHP] avoid Denial of Service

2009-10-08 Thread Ashley Sheridan
On Thu, 2009-10-08 at 19:40 +0530, Gaurav Kumar wrote:

 Not sure what exactly you are looking for.
 
 Anyways, some common practice are request for API key, username / password
 tokens before providing access to a service.
 
 Thanks,
 
 Gaurav Kumar
 
 
 On Thu, Oct 8, 2009 at 7:06 PM, Gerardo Benitez 
 gerardobeni...@gmail.comwrote:
 
  Hi everybody!
 
 
  I want to get some tips about how avoid a attack of Denial of service.  May
  be somebody can about your experience with Php o some configuration of
  apache, o other software that help in these case.
 
 
  Thanks in advance.
 
 
  --
  Gerardo Benitez
 


If you are using Apache there are a bunch of different DoS modules that
you can use:

http://www.google.co.uk/search?q=apache
+dosie=utf-8oe=utf-8aq=trls=org.mozilla:en-US:officialclient=firefox-a

Also, if you are in full control of the server, you may be able to
configure firewalls for this sort of thing.

It gets more complex when you're attacked with a DDoS (Distributed
Denial of Service) as there's no real hard-and-fast way to prevent them,
as they could genuinely be legitimate requests to your server and not
attacks. As a distributed attack comes from many sources, you can't
reliably differentiate the valid requests from the malicious ones.

Thanks,
Ash
http://www.ashleysheridan.co.uk