Solved

Apache Denial of Service

Posted on 2012-04-01
6
271 Views
Last Modified: 2012-06-05
So, we had a bot that was "scraping" content from us, images, videos etc. It was able to use up all available slots on apache therefor causing a DoS. Normally this is pretty simple to prevent using IPtables. The problem is our setup is more complex.


Load Balancer > Proxie > Front-End > Applications > - > Shared Assets


Our front ends do not see the "source ip" because the traffic gets sent from the load balance which then inputs a "x-forward-for" into the http header. Wondering what the best way of limiting connections via the x-forward-for are without adding much overhead, ie: mod_security
0
Comment
Question by:syscrash
  • 3
  • 3
6 Comments
 
LVL 77

Expert Comment

by:arnold
ID: 37793996
Why not limit it on the proxy?
I do not think you would be able to use redirect, conditional redirect referencing a http header that is being passed by the proxy.
Is the proxy setup as reverse?
0
 
LVL 1

Accepted Solution

by:
syscrash earned 0 total points
ID: 37794013
Yes, setup as reverse. The proxy in this case is actually not caching the "shared assets" but some day will be. So, the shared asset(front end) is the issue. It sees the source ip4 address only via the x-forward-for in the http header.
0
 
LVL 77

Expert Comment

by:arnold
ID: 37794030
The proxy presumably also has iptables and that is where you can and should block the source ip. Otherwise you have to go up the routing path to the firewall in front of the loadbalancer if any, or up to the router etc.
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 
LVL 1

Author Comment

by:syscrash
ID: 37794040
Well it would have to be done at the perimeter, which is one option. Any major side affects that anyone can think of? My thought is to limit tcp traffic to port 80 and 8080 something like 50 connections per ip or similar something high enough to not get false positives.
0
 
LVL 77

Expert Comment

by:arnold
ID: 37794135
Your apache config allows per Clint sequential requests? I.e. single connection retrieves multiple page/objects?

You could configure apache to proxy the tomcat such that access to port 8080 will not be necessary.
http://tomcat.apache.org/connectors-doc-archive/jk2/jk/workershowto.html
Depending on where you are you might limit proxy servers that are common in some countries/regions.
0
 
LVL 1

Author Closing Comment

by:syscrash
ID: 38048012
Used reverse proxy setup (squid) not as vulnerable to slowloris types of attacks.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

An overview of HIPAA and guidance on this topic that Experts Exchange members can offer.
In 2017, ransomware will become so virulent and widespread that if you aren’t a victim yourself, you will know someone who is.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now