Limiting traffic to Apache

Without switching to Squid, there are several parameters you can set on
Apache to control the number of simultaneous connections: 
 
ListenBacklog sets the number of maximum number of
waiting-to-be-accepted-connections that are allowed to be queued before
connections fail.  The OS will fail these connections, so this is more
efficient that Apache returning some 5xx error code.
 
Once a connection has been accepted it is basically being handled by Apache,
and depending on the process model you're using (for Apache 2.0),
MaxClientConnections, ServerLimit, ThreadLimit, and MaxClients work together
to determine the maximum number of clients that can in accepted state at one
time.
 
I believe Apache has some traffic shaping functionality as well.
 
-- Bjorn


  _____  

From: blug-general-bounces-+qp3TudyjKPvfBIPTTProkB+6BGkLq7r@public.gmane.org
[mailto:blug-general-bounces-+qp3TudyjKPvfBIPTTProkB+6BGkLq7r@public.gmane.org] On Behalf Of Richard Ford
Sent: Wednesday, October 20, 2004 11:06
To: [email protected]; Beijing LUG general non-technical discussion list
- Not publicly posted
Subject: Re: [blug-general] (no subject)


You can use a reverse squid proxy and use "Session pools" to limit the rate.

I can't suggest why the server is crashing or the cause.

If you are concerned with any rough edges on FC2.  Try CentOS
http://www.centos.org.  It is RHEL.  I have the ISO's.

I am deploying a new company server in the next 2 weeks - and I plan to use
CentOS and not fedora.  I get the lovely RH feel with the robustness of RHEL
for free!

I have found FC2 to be completely stable on my desktop.

Can you post some of your logs that detail this DOS attack?

We had to move data centre's before because all the othert windows servers
had osme worm and we were at 30% packet loss and 400ms latency due to the
constant attempts to connect to one of our severs SMB ports.  Which we don't
have because it is Linux and also that no server in a data centre should
have - windows or linux.

In our case we could not rely on the ISP.  They blamed us - even though I
had MB's of logs and IP's of dropped offending packets.  Even my dshield.org
account fired up and they started to send me IDS alerts.

Anyway - I would start with some detailed forensics and unfortunately it
will be up to you.  Could I suggest setting up an identical server that can
server the same offending URL string and place it in a round robin DNS and
see how it performs under the same load.  A sort of "Honey Pot" so to speak.
See if it attracts any attention?

In fact there is a special "Honey Pot" all in one bundled Linux distro that
you could try.  It can be found on distrowatch.

Cheers,
RF.



On Wed, 2004-10-20 at 10:18 +0800, Chris Drumgoole wrote: 

Hey,



I am having an issue with (what I think are) attackers bringing down

my fedora core 2 system by spawning tons of (more than 100, some times

up to 1000) PDF downloads from my site at once causing system

resources to go to crap and the system dies.  Have to do a physical

reboot - can't SSH in.  It is Fedore Core 2, HP ProLiant G3, gig ram,

etc...  First of all, I am not sure why the machine can't handle it...

 I am using the Fedora Core 2 default install of Apache 2.



I am thinking there must be a way to limit number of current

connections by IP address to apache, but I am not sure how - or is

there another way to do this?  Do you think this is even a DOS attack?

 Has happened many times over the past 3 months, I don't think it is

just a flashget or other download manager, seems too fishy...



Also, I don't understand why the system eventually hangs...  Not too

happy with the HP, but it can't be a hardware issue, so I am guessing

Fedora Core 2 is the evil doer (I believe someone from this board

suggested that I use it.. even for a production server...)



Any ideas?



Thanks



Chris

_______________________________________________
blug-general list
[email protected]
http://list.beijinglug.org/cgi-bin/mailman/listinfo/blug-general