How can I limit the number of concurrent CGI invocations in Apache 2.2.x?
More specifically, my problem is this: I have Apache hosting a Bugzilla instance and other stuff on one server. There's very little legitimate concurrent use of Bugzilla. However, it's trivial to mount a Denial of Service attack on the whole server by ignoring robots.txt and simply fetching a lot of bug pages that fork a process and hit a database.
Well the answer greatly depends on your CGI process manager. With PHP-FPM via FastCGI, you'd modify pm.max_children. With FCGID you'd define either FcgidMaxProcesses and/or FcgidMaxProcessesPerClass. With FastCGI you'd most likely tweak maxClassProcesses or maxProcesses.
The documentation for whichever process manager you're using will have the exact syntax on details.
you could use something like mod_cband to perform the throttling at a bandwidth rather than a process level.
