Re: [us...@httpd] slowloris mitigation

2010-04-14 Thread Nerius Landys
> Posted to users@ (as well as dev@) in case anyone wants to > report experiences - good or bad - on using it. I have tried using various Apache modules to address possibilities of Slowloris attacks. Finally, after not being satisfied with what existing modules had to offer, I ended up using oper

[us...@httpd] slowloris mitigation

2010-04-14 Thread Nick Kew
When slowloris first hit the headlines, it generated bad press for us: we offered no defence beyond raising your resource limits. I hacked up mod_noloris as a stopgap solution, but it's not really recommended for anything beyond ticking a box labelled "defence against slowloris-type attacks". Sinc