slow post attack mitigation breaks slow file uploads

Question

To mitigate against slow post attacks, I set the following in my apache.

RequestReadTimeout header=5-20,MinRate=500 body=10-60,MinRate=500

The problem with this is when users are uploading files on a slow connection, their connection gets dropped.

Is there a way to accommodate slow uploads while also protecting against slow post attacks?

How slow? That config should be sufficient even for dialup connections! — Michael Hampton, Feb 24 '15 at 23:44
Well, if they are uploading say a 20mb file on a slow connection, this could take 4-5 minutes. — user788171, Feb 24 '15 at 23:59

score 0 · Answer 1 · answered Apr 21 '15 at 02:04

You can use mod_qos and its QS_SrvMaxConnPerIP to limit how many connections can be made by a given IP address. That can prevent it as long as the attacker isn't using too many different IP addresses. If you have MaxClients of 150 and QS_SrvMaxConnPerIP of 45, they could attack from 3 different IPs and you'd have 15 connections available (150 - (45*3) = 135. Be careful not to set this too low in case you have multiple people from the same office accessing the site since each single browser uses multiple connections at once when loading a webpage.

slow post attack mitigation breaks slow file uploads

1 Answers1