LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 01-31-2011, 10:44 PM   #1
hydraMax
Member
 
Registered: Jul 2010
Location: Skynet
Distribution: Debian + Emacs
Posts: 467
Blog Entries: 60

Rep: Reputation: 51
Lighttpd: Slow HTTP POST Attack


http://www.darkreading.com/vulnerabi...532/index.html

I ran across the above article, which described a DoS attack in which requests are sent very slowly to the Web server. I'm running lighttpd 1.4.28 on a Gentoo Linux server, and I'm wondering if there is anything I could do in preparation to defend against such an attack.

A bug report <http://redmine.lighttpd.net/issues/2147> seems to indicate that there was a patch in place already against this sort of attack, but I wanted to be sure that was the same thing and if there was anything else I needed to do. Thanks.
 
Old 02-01-2011, 06:26 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,458
Blog Entries: 54

Rep: Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897
ModSecurity >=2.5.13 seems to be suggested:
Code:
Add directive: 
"RequestReadTimeout body=30"

Add a rule:
SecRule RESPONSE_STATUS "@streq 408" "phase:5,t:none,nolog,pass, setvar:ip.slow_dos_counter=+1,expirevar:ip. slow_dos_counter=60"
SecRule IP:SLOW_DOS_COUNTER "@gt 5" \ "phase:1,t:none,log,drop, msg:'Client Connection Dropped due to high # of slow DoS alerts'"
for more see the Chaptersinwebsecurity presentation at http://www.hybridsec.com/papers/OWAS...l-HTTP-DoS.ppt (slides 8 - 15). Note just adding these to ModSecurity is not enough: downloading the attack POC and testing it should definitely be the next step to find out if it works as advertised.
 
Old 02-02-2011, 11:21 PM   #3
hydraMax
Member
 
Registered: Jul 2010
Location: Skynet
Distribution: Debian + Emacs
Posts: 467
Blog Entries: 60

Original Poster
Rep: Reputation: 51
Quote:
Originally Posted by unSpawn View Post
ModSecurity >=2.5.13 seems to be suggested:
Code:
Add directive: 
"RequestReadTimeout body=30"

Add a rule:
SecRule RESPONSE_STATUS "@streq 408" "phase:5,t:none,nolog,pass, setvar:ip.slow_dos_counter=+1,expirevar:ip. slow_dos_counter=60"
SecRule IP:SLOW_DOS_COUNTER "@gt 5" \ "phase:1,t:none,log,drop, msg:'Client Connection Dropped due to high # of slow DoS alerts'"
for more see the Chaptersinwebsecurity presentation at http://www.hybridsec.com/papers/OWAS...l-HTTP-DoS.ppt (slides 8 - 15). Note just adding these to ModSecurity is not enough: downloading the attack POC and testing it should definitely be the next step to find out if it works as advertised.
Apache only?
 
Old 02-04-2011, 10:48 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,458
Blog Entries: 54

Rep: Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897
Yeah, you're right. I did read some texts about converting some string matches in an effort to mimic part of mod_security but Lighttpd uses Lua and I don't...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Lighttpd running too slow woden05 Linux - Server 0 01-18-2009 05:38 AM
LXer: Unix And Linux PDF Telnet Curiosity - When HTTP Error Pages Don't Attack! LXer Syndicated Linux News 0 12-09-2008 09:30 AM
http sercurity problem/attack? guillermo Linux - Security 3 09-27-2007 10:21 PM
Traffic attack, huge size in http log vincentltl Linux - Security 2 04-03-2006 06:52 AM


All times are GMT -5. The time now is 12:20 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration