Apache Denial of Service

Posted on 2012-04-01
Last Modified: 2012-06-05
So, we had a bot that was "scraping" content from us, images, videos etc. It was able to use up all available slots on apache therefor causing a DoS. Normally this is pretty simple to prevent using IPtables. The problem is our setup is more complex.

Load Balancer > Proxie > Front-End > Applications > - > Shared Assets

Our front ends do not see the "source ip" because the traffic gets sent from the load balance which then inputs a "x-forward-for" into the http header. Wondering what the best way of limiting connections via the x-forward-for are without adding much overhead, ie: mod_security
Question by:syscrash
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
LVL 78

Expert Comment

ID: 37793996
Why not limit it on the proxy?
I do not think you would be able to use redirect, conditional redirect referencing a http header that is being passed by the proxy.
Is the proxy setup as reverse?

Accepted Solution

syscrash earned 0 total points
ID: 37794013
Yes, setup as reverse. The proxy in this case is actually not caching the "shared assets" but some day will be. So, the shared asset(front end) is the issue. It sees the source ip4 address only via the x-forward-for in the http header.
LVL 78

Expert Comment

ID: 37794030
The proxy presumably also has iptables and that is where you can and should block the source ip. Otherwise you have to go up the routing path to the firewall in front of the loadbalancer if any, or up to the router etc.
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.


Author Comment

ID: 37794040
Well it would have to be done at the perimeter, which is one option. Any major side affects that anyone can think of? My thought is to limit tcp traffic to port 80 and 8080 something like 50 connections per ip or similar something high enough to not get false positives.
LVL 78

Expert Comment

ID: 37794135
Your apache config allows per Clint sequential requests? I.e. single connection retrieves multiple page/objects?

You could configure apache to proxy the tomcat such that access to port 8080 will not be necessary.
Depending on where you are you might limit proxy servers that are common in some countries/regions.

Author Closing Comment

ID: 38048012
Used reverse proxy setup (squid) not as vulnerable to slowloris types of attacks.

Featured Post

SendBlaster Pro 4 - Bulk Email Sending Software

SendBlaster 4 Pro - Best Bulk Emailing Sending Software
Automatic Subscribe / Unsubscribe Processing
Great for Newsletters & Mass Mailings
Optional HTML & Text Composition
Integration with Google Features
Built in Spam Score Checking
Free Professional Templates - Feature Packed!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
sed command 3 26
Open attachments in viewer, not main app 4 28
Question on CIA's tool and frameworks on VAult7 arsenal. 7 56
Windows 10 14 34
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question