Rule of thumb for settings anti-DOS parameters in Apache for web appHow to best defend against a “slowloris” DOS attack against an Apache web server?Apache: What is the best anti Denial of Service module and caching combination for a penny auction site?How to make a certain web app on Apache server to use different proxy for downloading?Apache problems in performance test with mod_reqtimeoutCyclos4 - Apache as frontend for a Tomcat appnginx reverse proxy for Apache and a Node appReducing Apache Memory usage and Average Process Size Valuesnort rule for rdp dos attackApache case Insensitive mod_rewrite for single ruleHardening TLS web server Apache settings
How to get cool night-vision without lame drawbacks?
Should developer taking test phones home or put in office?
Can ADFS connect to other SSO services?
Hand soldering SMD 1206 components
Underbar nabla symbol doesn't work
Cascading Repair Costs following Blown Head Gasket on a 2004 Subaru Outback
C-152 carb heat on before landing in hot weather?
Has there been any indication at all that further negotiation between the UK and EU is possible?
Why did pressing the joystick button spit out keypresses?
Find the probability that the 8th woman to appear is in 17th position.
What reason would an alien civilization have for building a Dyson Sphere (or Swarm) if cheap Nuclear fusion is available?
Is a single radon-daughter atom in air a solid?
Are there any efficient algorithms to solve longest path problem in networks with cycles?
How does a blind passenger not die, if driver becomes unconscious
Why doesn't a marching band have strings?
Why do textbooks often include the solutions to odd or even numbered problems but not both?
Intuition for capacitors in series
3D Crossword, Cryptic, Statue View & Maze
How much will studying magic in an academy cost?
In the Marvel universe, can a human have a baby with any non-human?
Is there a way to split the metadata to custom folders?
What's currently blocking the construction of the wall between Mexico and the US?
What does "play with your toy’s toys" mean?
How can I politely work my way around not liking coffee or beer when it comes to professional networking?
Rule of thumb for settings anti-DOS parameters in Apache for web app
How to best defend against a “slowloris” DOS attack against an Apache web server?Apache: What is the best anti Denial of Service module and caching combination for a penny auction site?How to make a certain web app on Apache server to use different proxy for downloading?Apache problems in performance test with mod_reqtimeoutCyclos4 - Apache as frontend for a Tomcat appnginx reverse proxy for Apache and a Node appReducing Apache Memory usage and Average Process Size Valuesnort rule for rdp dos attackApache case Insensitive mod_rewrite for single ruleHardening TLS web server Apache settings
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.
The Apache security guide recommends to set the following parameters to help prevent DOS attacks:
- KeepAlive
- KeepAliveTimeout
- LimitRequestBody
- LimitRequestFields
- LimitRequestFieldSize
- LimitRequestLine
- LimitXMLRequestBody
- MaxClients
- MaxKeepAliveRequests
- MaxRequestWorkers
- RequestReadTimeout
- TimeOut
Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?
apache-2.4 denial-of-service server-settings
add a comment |
I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.
The Apache security guide recommends to set the following parameters to help prevent DOS attacks:
- KeepAlive
- KeepAliveTimeout
- LimitRequestBody
- LimitRequestFields
- LimitRequestFieldSize
- LimitRequestLine
- LimitXMLRequestBody
- MaxClients
- MaxKeepAliveRequests
- MaxRequestWorkers
- RequestReadTimeout
- TimeOut
Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?
apache-2.4 denial-of-service server-settings
add a comment |
I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.
The Apache security guide recommends to set the following parameters to help prevent DOS attacks:
- KeepAlive
- KeepAliveTimeout
- LimitRequestBody
- LimitRequestFields
- LimitRequestFieldSize
- LimitRequestLine
- LimitXMLRequestBody
- MaxClients
- MaxKeepAliveRequests
- MaxRequestWorkers
- RequestReadTimeout
- TimeOut
Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?
apache-2.4 denial-of-service server-settings
I have Apache 2.4 running on a Windows 10 server, listening to connections from the Internet. This Apache instance serves an in-house PHP application. The PHP application connects to a local database and feeds data to a few mobile clients in JSON format. The data fed to the clients is mostly textual, but there are some word/excel/other documents as well.
The Apache security guide recommends to set the following parameters to help prevent DOS attacks:
- KeepAlive
- KeepAliveTimeout
- LimitRequestBody
- LimitRequestFields
- LimitRequestFieldSize
- LimitRequestLine
- LimitXMLRequestBody
- MaxClients
- MaxKeepAliveRequests
- MaxRequestWorkers
- RequestReadTimeout
- TimeOut
Considering the above scenario and a maximum number of 50 concurrent users, what would be the optimal settings for the above parameters?
apache-2.4 denial-of-service server-settings
apache-2.4 denial-of-service server-settings
edited Jun 6 at 20:44
kubanczyk
10.9k4 gold badges30 silver badges46 bronze badges
10.9k4 gold badges30 silver badges46 bronze badges
asked Jun 6 at 19:41
SteveSteve
1114 bronze badges
1114 bronze badges
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970446%2frule-of-thumb-for-settings-anti-dos-parameters-in-apache-for-web-app%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f970446%2frule-of-thumb-for-settings-anti-dos-parameters-in-apache-for-web-app%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown