NginX configuration to prevent “Slow HTTP Denial of Service” Come Celebrate our 10 Year Anniversary!Why are NginX and Lighttpd not affected by Slowloris?nginx HTTPS serving with same config as HTTPIn Nginx, how can I rewrite all http requests to https while maintaining sub-domain?Help needed setting up nginx to serve static filesInstalling redmine on ubuntu 10.10Trouble with nginx and serving from multiple directories under the same domainNginx + Passenger = Slow responsePHP app breaks on Nginx, but works on ApacheChange Nginx document root from /usr/share/nginx to /etc/nginxnginx configuration troublenginx limit_req denial of service
NginX configuration to prevent “Slow HTTP Denial of Service”
Come Celebrate our 10 Year Anniversary!Why are NginX and Lighttpd not affected by Slowloris?nginx HTTPS serving with same config as HTTPIn Nginx, how can I rewrite all http requests to https while maintaining sub-domain?Help needed setting up nginx to serve static filesInstalling redmine on ubuntu 10.10Trouble with nginx and serving from multiple directories under the same domainNginx + Passenger = Slow responsePHP app breaks on Nginx, but works on ApacheChange Nginx document root from /usr/share/nginx to /etc/nginxnginx configuration troublenginx limit_req denial of service
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
0
I'm trying to configure NginX (in combination with Passenger and Rails) to prevent "Slow HTTP Denial of Service".
What I'm trying to do to prevent it, is limiting the amount of requests per connections to 5 and decrease the timeouts.
This is my configuration:
worker_processes 1;
...
events
worker_connections 1024;
http
...
limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 5;
client_body_timeout 15;
client_header_timeout 15;
keepalive_timeout 15;
send_timeout 15;
...
server
...
Our testing software, Qualisguard, says it's still not prevented against Slow HTTP DoS.
Would this even work, or is the configuration itself incorrect?
centos nginx ruby-on-rails phusion-passenger
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
add a comment |
0
I'm trying to configure NginX (in combination with Passenger and Rails) to prevent "Slow HTTP Denial of Service".
What I'm trying to do to prevent it, is limiting the amount of requests per connections to 5 and decrease the timeouts.
This is my configuration:
worker_processes 1;
...
events
worker_connections 1024;
http
...
limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 5;
client_body_timeout 15;
client_header_timeout 15;
keepalive_timeout 15;
send_timeout 15;
...
server
...
Our testing software, Qualisguard, says it's still not prevented against Slow HTTP DoS.
Would this even work, or is the configuration itself incorrect?
centos nginx ruby-on-rails phusion-passenger
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
Why only one worker process? Have you seen serverfault.com/q/281581/211028
– Alexey Ten
May 7 '14 at 4:48
@AlexeyTen I don't know, it was like that when I first saw it. Would moreworker_processesand lessworker_connectionsbe better?
– Tim Baas
May 7 '14 at 8:17
They both should be increased. See also stackoverflow.com/q/7325211/1016033
– Alexey Ten
May 7 '14 at 8:36
Wow, thanks dude! Never knew our settings were this low!
– Tim Baas
May 7 '14 at 9:53
I think this link can be really helpful with your configuration. Slowloris DoS Attack / Nginx Configuration
– ngrammen
Apr 17 at 8:24
add a comment |
0
0
0
I'm trying to configure NginX (in combination with Passenger and Rails) to prevent "Slow HTTP Denial of Service".
What I'm trying to do to prevent it, is limiting the amount of requests per connections to 5 and decrease the timeouts.
This is my configuration:
worker_processes 1;
...
events
worker_connections 1024;
http
...
limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 5;
client_body_timeout 15;
client_header_timeout 15;
keepalive_timeout 15;
send_timeout 15;
...
server
...
Our testing software, Qualisguard, says it's still not prevented against Slow HTTP DoS.
Would this even work, or is the configuration itself incorrect?
centos nginx ruby-on-rails phusion-passenger
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
I'm trying to configure NginX (in combination with Passenger and Rails) to prevent "Slow HTTP Denial of Service".
What I'm trying to do to prevent it, is limiting the amount of requests per connections to 5 and decrease the timeouts.
This is my configuration:
worker_processes 1;
...
events
worker_connections 1024;
http
...
limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 5;
client_body_timeout 15;
client_header_timeout 15;
keepalive_timeout 15;
send_timeout 15;
...
server
...
Our testing software, Qualisguard, says it's still not prevented against Slow HTTP DoS.
Would this even work, or is the configuration itself incorrect?
centos nginx ruby-on-rails phusion-passenger
centos nginx ruby-on-rails phusion-passenger
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
asked May 6 '14 at 14:13
Tim BaasTim Baas
1811415
1811415
Why only one worker process? Have you seen serverfault.com/q/281581/211028
– Alexey Ten
May 7 '14 at 4:48
@AlexeyTen I don't know, it was like that when I first saw it. Would moreworker_processesand lessworker_connectionsbe better?
– Tim Baas
May 7 '14 at 8:17
They both should be increased. See also stackoverflow.com/q/7325211/1016033
– Alexey Ten
May 7 '14 at 8:36
Wow, thanks dude! Never knew our settings were this low!
– Tim Baas
May 7 '14 at 9:53
I think this link can be really helpful with your configuration. Slowloris DoS Attack / Nginx Configuration
– ngrammen
Apr 17 at 8:24
add a comment |
Why only one worker process? Have you seen serverfault.com/q/281581/211028
– Alexey Ten
May 7 '14 at 4:48
@AlexeyTen I don't know, it was like that when I first saw it. Would moreworker_processesand lessworker_connectionsbe better?
– Tim Baas
May 7 '14 at 8:17
They both should be increased. See also stackoverflow.com/q/7325211/1016033
– Alexey Ten
May 7 '14 at 8:36
Wow, thanks dude! Never knew our settings were this low!
– Tim Baas
May 7 '14 at 9:53
I think this link can be really helpful with your configuration. Slowloris DoS Attack / Nginx Configuration
– ngrammen
Apr 17 at 8:24
Why only one worker process? Have you seen serverfault.com/q/281581/211028
– Alexey Ten
May 7 '14 at 4:48
Why only one worker process? Have you seen serverfault.com/q/281581/211028
– Alexey Ten
May 7 '14 at 4:48
@AlexeyTen I don't know, it was like that when I first saw it. Would more
worker_processes and less worker_connections be better?– Tim Baas
May 7 '14 at 8:17
@AlexeyTen I don't know, it was like that when I first saw it. Would more
worker_processes and less worker_connections be better?– Tim Baas
May 7 '14 at 8:17
They both should be increased. See also stackoverflow.com/q/7325211/1016033
– Alexey Ten
May 7 '14 at 8:36
They both should be increased. See also stackoverflow.com/q/7325211/1016033
– Alexey Ten
May 7 '14 at 8:36
Wow, thanks dude! Never knew our settings were this low!
– Tim Baas
May 7 '14 at 9:53
Wow, thanks dude! Never knew our settings were this low!
– Tim Baas
May 7 '14 at 9:53
I think this link can be really helpful with your configuration. Slowloris DoS Attack / Nginx Configuration
– ngrammen
Apr 17 at 8:24
I think this link can be really helpful with your configuration. Slowloris DoS Attack / Nginx Configuration
– ngrammen
Apr 17 at 8:24
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f593401%2fnginx-configuration-to-prevent-slow-http-denial-of-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f593401%2fnginx-configuration-to-prevent-slow-http-denial-of-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Why only one worker process? Have you seen serverfault.com/q/281581/211028
– Alexey Ten
May 7 '14 at 4:48
@AlexeyTen I don't know, it was like that when I first saw it. Would more
worker_processesand lessworker_connectionsbe better?– Tim Baas
May 7 '14 at 8:17
They both should be increased. See also stackoverflow.com/q/7325211/1016033
– Alexey Ten
May 7 '14 at 8:36
Wow, thanks dude! Never knew our settings were this low!
– Tim Baas
May 7 '14 at 9:53
I think this link can be really helpful with your configuration. Slowloris DoS Attack / Nginx Configuration
– ngrammen
Apr 17 at 8:24