Re: SSL handshake attack mitigation

2019-11-06 Thread Sergey A. Osokin
Hi, On Wed, Nov 06, 2019 at 02:41:15PM -0500, mogwai wrote: > Greetings! > > I run a bunch of sites on nginx-plus-r19 (OpenSSL 1.0.2k-fips) and was > recently hit by a nasty DDoS SSL handshake attack. there are several techics are avaialble to mitigate DDoS attacks with NGINX and NGINX Plus, pl

Custom Sticky Module development

2019-11-06 Thread bob bob
Hi guys We have a use case when we plan to use Nginx as our load-balancer with a session persistence requirement. We are using it in the context of Kubernetes. Nothing special here Our specific need is that each user will have one non-shared pod which means that once a upstream server is ass

Re: SSL handshake attack mitigation

2019-11-06 Thread lists
IMHO you did the right thing with fail2ban. I don't see how a firewall is "expensive" other than they they are a little RAM heavy. Half the internet traffic is bots. That doesn't even count the hot linkers. So the reality is you will need a firewall to block what doesn't have eyeballs, namely da

SSL handshake attack mitigation

2019-11-06 Thread mogwai
Greetings! I run a bunch of sites on nginx-plus-r19 (OpenSSL 1.0.2k-fips) and was recently hit by a nasty DDoS SSL handshake attack. I noticed nginx worker processes suddenly eating all available CPU and the "Handshakes failed" counter in the nginx plus dashboard suddenly climbing out of proporti