How To Defend slowloris DDoS With mod_qos (Apache2 On Debian [Lenny])

[ Thanks to Falko
Timme for this link. ]

“Some servers may have a smaller tolerance for timeouts
than others, but Slowloris can compensate for that by customizing
the timeouts. There is an added function to help you get started
with finding the right sized timeouts as well. As a side note,
Slowloris does not consume a lot of resources so modern operating
systems don’t have a need to start shutting down sockets when they
come under attack, which actually in turn makes Slowloris better
than a typical flooder in certain circumstances. Think of Slowloris
as the HTTP equivalent of a SYN flood.

“I recently had to defend a live attack with slowloris-dos from
a botnet. The load-impact is very low but http quits serving very
fast. A quick approach was to mangle with timeout settings, wich is
fine to defend a single attacker but leads into new issues (ie.
large NAT on client-side).

“mod_qos gives some fine-grained opportunities to scale the
number of used connections and to defend an attack according to
bandwidth limits. Unfortunately it is only available as
source-package and there are many possible settings, wich might be
hard to setup for this special case. So I provide the way that
helped me.”

Complete Story