Re: Limiting traffic to Apache

test


On Sun, 2004-10-31 at 21:26 +0800, Bjørn Stabell wrote:

> Without switching to Squid, there are several parameters you can set
> on Apache to control the number of simultaneous connections: 
>  
> ListenBacklog sets the number of maximum number of
> waiting-to-be-accepted-connections that are allowed to be queued
> before connections fail.  The OS will fail these connections, so this
> is more efficient that Apache returning some 5xx error code.
>  
> Once a connection has been accepted it is basically being handled by
> Apache, and depending on the process model you're using (for Apache
> 2.0), MaxClientConnections, ServerLimit, ThreadLimit, and MaxClients
> work together to determine the maximum number of clients that can in
> accepted state at one time.
>  
> I believe Apache has some traffic shaping functionality as well.
>  
> -- Bjorn
> 
> 
>         
>         ______________________________________________________________
>         From: blug-general-bounces-+qp3TudyjKPvfBIPTTProkB+6BGkLq7r@public.gmane.org
>         [mailto:blug-general-bounces-+qp3TudyjKPvfBIPTTProkB+6BGkLq7r@public.gmane.org] On Behalf Of
>         Richard Ford
>         Sent: Wednesday, October 20, 2004 11:06
>         To: [email protected]; Beijing LUG general non-technical
>         discussion list - Not publicly posted
>         Subject: Re: [blug-general] (no subject)
>         
>         
>         You can use a reverse squid proxy and use "Session pools" to
>         limit the rate.
>         
>         I can't suggest why the server is crashing or the cause.
>         
>         If you are concerned with any rough edges on FC2.  Try CentOS
>         http://www.centos.org.  It is RHEL.  I have the ISO's.
>         
>         I am deploying a new company server in the next 2 weeks - and
>         I plan to use CentOS and not fedora.  I get the lovely RH feel
>         with the robustness of RHEL for free!
>         
>         I have found FC2 to be completely stable on my desktop.
>         
>         Can you post some of your logs that detail this DOS attack?
>         
>         We had to move data centre's before because all the othert
>         windows servers had osme worm and we were at 30% packet loss
>         and 400ms latency due to the constant attempts to connect to
>         one of our severs SMB ports.  Which we don't have because it
>         is Linux and also that no server in a data centre should have
>         - windows or linux.
>         
>         In our case we could not rely on the ISP.  They blamed us -
>         even though I had MB's of logs and IP's of dropped offending
>         packets.  Even my dshield.org account fired up and they
>         started to send me IDS alerts.
>         
>         Anyway - I would start with some detailed forensics and
>         unfortunately it will be up to you.  Could I suggest setting
>         up an identical server that can server the same offending URL
>         string and place it in a round robin DNS and see how it
>         performs under the same load.  A sort of "Honey Pot" so to
>         speak.  See if it attracts any attention?
>         
>         In fact there is a special "Honey Pot" all in one bundled
>         Linux distro that you could try.  It can be found on
>         distrowatch.
>         
>         Cheers,
>         RF.
>         
>         
>         
>         On Wed, 2004-10-20 at 10:18 +0800, Chris Drumgoole wrote: 
>         
>         > Hey,
>         > 
>         > I am having an issue with (what I think are) attackers bringing down
>         > my fedora core 2 system by spawning tons of (more than 100, some times
>         > up to 1000) PDF downloads from my site at once causing system
>         > resources to go to crap and the system dies.  Have to do a physical
>         > reboot - can't SSH in.  It is Fedore Core 2, HP ProLiant G3, gig ram,
>         > etc...  First of all, I am not sure why the machine can't handle it...
>         >  I am using the Fedora Core 2 default install of Apache 2.
>         > 
>         > I am thinking there must be a way to limit number of current
>         > connections by IP address to apache, but I am not sure how - or is
>         > there another way to do this?  Do you think this is even a DOS attack?
>         >  Has happened many times over the past 3 months, I don't think it is
>         > just a flashget or other download manager, seems too fishy...
>         > 
>         > Also, I don't understand why the system eventually hangs...  Not too
>         > happy with the HP, but it can't be a hardware issue, so I am guessing
>         > Fedora Core 2 is the evil doer (I believe someone from this board
>         > suggested that I use it.. even for a production server...)
>         > 
>         > Any ideas?
>         > 
>         > Thanks
>         > 
>         > Chris
>         >

_______________________________________________
blug-general list
[email protected]
http://list.beijinglug.org/cgi-bin/mailman/listinfo/blug-general