Rule of thumb for settings anti-DOS parameters in Apache for web appHow to best defend against a “slowloris” DOS attack against an Apache web server?Apache: What is the best anti Denial of Service module and caching combination for a penny auction site?How to make a certain web app on Apache server to use different proxy for downloading?Apache problems in performance test with mod_reqtimeoutCyclos4 - Apache as frontend for a Tomcat appnginx reverse proxy for Apache and a Node appReducing Apache Memory usage and Average Process Size Valuesnort rule for rdp dos attackApache case Insensitive mod_rewrite for single ruleHardening TLS web server Apache settings

How to get cool night-vision without lame drawbacks?

Should developer taking test phones home or put in office?

Can ADFS connect to other SSO services?

Hand soldering SMD 1206 components

Underbar nabla symbol doesn't work

Cascading Repair Costs following Blown Head Gasket on a 2004 Subaru Outback

C-152 carb heat on before landing in hot weather?

Has there been any indication at all that further negotiation between the UK and EU is possible?

Why did pressing the joystick button spit out keypresses?

Find the probability that the 8th woman to appear is in 17th position.

What reason would an alien civilization have for building a Dyson Sphere (or Swarm) if cheap Nuclear fusion is available?

Is a single radon-daughter atom in air a solid?

Are there any efficient algorithms to solve longest path problem in networks with cycles?

How does a blind passenger not die, if driver becomes unconscious

Why doesn't a marching band have strings?

Why do textbooks often include the solutions to odd or even numbered problems but not both?

Intuition for capacitors in series

3D Crossword, Cryptic, Statue View & Maze

How much will studying magic in an academy cost?

In the Marvel universe, can a human have a baby with any non-human?

Is there a way to split the metadata to custom folders?

What's currently blocking the construction of the wall between Mexico and the US?

What does "play with your toy’s toys" mean?

How can I politely work my way around not liking coffee or beer when it comes to professional networking?



Rule of thumb for settings anti-DOS parameters in Apache for web app


How to best defend against a “slowloris” DOS attack against an Apache web server?Apache: What is the best anti Denial of Service module and caching combination for a penny auction site?How to make a certain web app on Apache server to use different proxy for downloading?Apache problems in performance test with mod_reqtimeoutCyclos4 - Apache as frontend for a Tomcat appnginx reverse proxy for Apache and a Node appReducing Apache Memory usage and Average Process Size Valuesnort rule for rdp dos attackApache case Insensitive mod_rewrite for single ruleHardening TLS web server Apache settings






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;








0















I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.



The Apache security guide recommends to set the following parameters to help prevent DOS attacks:



  • KeepAlive

  • KeepAliveTimeout

  • LimitRequestBody

  • LimitRequestFields

  • LimitRequestFieldSize

  • LimitRequestLine

  • LimitXMLRequestBody

  • MaxClients

  • MaxKeepAliveRequests

  • MaxRequestWorkers

  • RequestReadTimeout

  • TimeOut

Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?










share|improve this question






























    0















    I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.



    The Apache security guide recommends to set the following parameters to help prevent DOS attacks:



    • KeepAlive

    • KeepAliveTimeout

    • LimitRequestBody

    • LimitRequestFields

    • LimitRequestFieldSize

    • LimitRequestLine

    • LimitXMLRequestBody

    • MaxClients

    • MaxKeepAliveRequests

    • MaxRequestWorkers

    • RequestReadTimeout

    • TimeOut

    Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?










    share|improve this question


























      0












      0








      0








      I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.



      The Apache security guide recommends to set the following parameters to help prevent DOS attacks:



      • KeepAlive

      • KeepAliveTimeout

      • LimitRequestBody

      • LimitRequestFields

      • LimitRequestFieldSize

      • LimitRequestLine

      • LimitXMLRequestBody

      • MaxClients

      • MaxKeepAliveRequests

      • MaxRequestWorkers

      • RequestReadTimeout

      • TimeOut

      Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?










      share|improve this question
















      I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.



      The Apache security guide recommends to set the following parameters to help prevent DOS attacks:



      • KeepAlive

      • KeepAliveTimeout

      • LimitRequestBody

      • LimitRequestFields

      • LimitRequestFieldSize

      • LimitRequestLine

      • LimitXMLRequestBody

      • MaxClients

      • MaxKeepAliveRequests

      • MaxRequestWorkers

      • RequestReadTimeout

      • TimeOut

      Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?







      apache-2.4 denial-of-service server-settings






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jun 6 at 20:44









      kubanczyk

      10.9k4 gold badges30 silver badges46 bronze badges




      10.9k4 gold badges30 silver badges46 bronze badges










      asked Jun 6 at 19:41









      SteveSteve

      1114 bronze badges




      1114 bronze badges




















          0






          active

          oldest

          votes














          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "2"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970446%2frule-of-thumb-for-settings-anti-dos-parameters-in-apache-for-web-app%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          0






          active

          oldest

          votes








          0






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Server Fault!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970446%2frule-of-thumb-for-settings-anti-dos-parameters-in-apache-for-web-app%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Wikipedia:Vital articles Мазмуну Biography - Өмүр баян Philosophy and psychology - Философия жана психология Religion - Дин Social sciences - Коомдук илимдер Language and literature - Тил жана адабият Science - Илим Technology - Технология Arts and recreation - Искусство жана эс алуу History and geography - Тарых жана география Навигация менюсу

          Bruxelas-Capital Índice Historia | Composición | Situación lingüística | Clima | Cidades irmandadas | Notas | Véxase tamén | Menú de navegacióneO uso das linguas en Bruxelas e a situación do neerlandés"Rexión de Bruxelas Capital"o orixinalSitio da rexiónPáxina de Bruselas no sitio da Oficina de Promoción Turística de Valonia e BruxelasMapa Interactivo da Rexión de Bruxelas-CapitaleeWorldCat332144929079854441105155190212ID28008674080552-90000 0001 0666 3698n94104302ID540940339365017018237

          What should I write in an apology letter, since I have decided not to join a company after accepting an offer letterShould I keep looking after accepting a job offer?What should I do when I've been verbally told I would get an offer letter, but still haven't gotten one after 4 weeks?Do I accept an offer from a company that I am not likely to join?New job hasn't confirmed starting date and I want to give current employer as much notice as possibleHow should I address my manager in my resignation letter?HR delayed background verification, now jobless as resignedNo email communication after accepting a formal written offer. How should I phrase the call?What should I do if after receiving a verbal offer letter I am informed that my written job offer is put on hold due to some internal issues?Should I inform the current employer that I am about to resign within 1-2 weeks since I have signed the offer letter and waiting for visa?What company will do, if I send their offer letter to another company