From 4f46f35697f07f916dafb64e99e2b59fa267500b Mon Sep 17 00:00:00 2001 From: Joshua Slive Date: Tue, 17 Jan 2006 16:01:56 +0000 Subject: [PATCH] Take a stab at documenting how we respond to DoS issues. Please review! git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@369825 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/misc/security_tips.html.en | 54 ++++++++++++++++++++++++ docs/manual/misc/security_tips.xml | 57 ++++++++++++++++++++++++++ 2 files changed, 111 insertions(+) diff --git a/docs/manual/misc/security_tips.html.en b/docs/manual/misc/security_tips.html.en index 6786a37210c..531441e5485 100644 --- a/docs/manual/misc/security_tips.html.en +++ b/docs/manual/misc/security_tips.html.en @@ -26,6 +26,7 @@ Some of the suggestions will be general, others specific to Apache.

top
+

Denial of Service (DoS) attacks

+ + + +

All network servers are subject to denial of service atacks + that attempt to prevent responses to clients by tying up the + resources of the server. It is not possible to prevent such + attacks entirely, but you can do certain things to mitigate the + problems that they create.

+ +

Often the most effective anti-DoS tools will be a firewall or + other operating-system tools. For example, most firewalls can be + configured to restrict the number of simultaneous connections from + any individual IP address or network, thus preventing a range of + simple attacks.

+ +

There are also certain Apache HTTP Server configuration + settings that can help mitigate problems:

+ + + +
top
+

Permissions on ServerRoot Directories

diff --git a/docs/manual/misc/security_tips.xml b/docs/manual/misc/security_tips.xml index 422d3317e20..5a777118724 100644 --- a/docs/manual/misc/security_tips.xml +++ b/docs/manual/misc/security_tips.xml @@ -52,6 +52,63 @@ +
+ + Denial of Service (DoS) attacks + +

All network servers are subject to denial of service atacks + that attempt to prevent responses to clients by tying up the + resources of the server. It is not possible to prevent such + attacks entirely, but you can do certain things to mitigate the + problems that they create.

+ +

Often the most effective anti-DoS tools will be a firewall or + other operating-system tools. For example, most firewalls can be + configured to restrict the number of simultaneous connections from + any individual IP address or network, thus preventing a range of + simple attacks.

+ +

There are also certain Apache HTTP Server configuration + settings that can help mitigate problems:

+ +
    +
  • The TimeOut directive + should be lowered on sites that are subject to DoS attacks. + Setting this to as low as a few seconds may be appropriate. See + also the KeepAliveTimeout + directive and various timeout-related directives provided by + other modules.
    • + +
  • On operating systems that support it, make sure that you use + the AcceptFilter directive + to offload part of the request processing to the operating + system. This is active by default in Apache httpd, but may + require reconfiguration of your kernel.
    • + +
  • Tune the MaxClients directive to allow + the server to handle the maximum number of simultaneous + connections without running out of resources. See also the performance tuning + documentation.
    • + +
  • The use of a threaded mpm may + allow you to handle more simultaneous connections, thereby + mitigating DoS attacks. Further, the event mpm + uses asynchronous processing to avoid devoting a thread to each + connection.
    • + +
  • There are a number of third-party modules available through + http://modules.apache.org/ + that can restrict certain client behaviors and thereby mitigate + DoS problems.
    • + +
+ +
+ +
Permissions on ServerRoot Directories -- 2.47.2