Debian 6 / Apache2 - Protection against Slowloris attacks

[Coniesan 92]

Hey @ all

For that people who are using Debian 6 and Apache could this be very nice!

People who are using nginx, you are normaly safe, but if you fuck your configs up, slowloris can be a problem for you, too

 

1. What is slowloris?

Slowloris is a perl script, which allows you to open hundreds of sessions on your webserver and hold them open!

So your webserver crashes if it reaches ~700 connections at the same time 

 

2. How to fix it?

1. Download and extract the mod

wget ftp://ftp.monshouwer.eu/pub/linux/mod_antiloris/mod_antiloris-0.4.tar.bz2
tar -jxvvf mod_antiloris-0.4.tar.bz2
cd mod_antiloris-0.4/

 

2. Install the compile kit:

apt-get install gcc apache2-threaded-dev

3. compile mod_antiloris

/usr/bin/apxs2 -i -c mod_antiloris.c

4. import the mod to apache

echo "LoadModule antiloris_module /usr/lib/apache2/modules/mod_antiloris.so" > /etc/apache2/mods-available/antiloris.load
a2enmod antiloris

5. restart it

/etc/init.d/apache2 restart

I hope you enjoy it!

Kind regards

[alexrafapt 0]

Good!

[Sphinx² 23]

Or use Nginx

 

Kind regards

Sphinx

[DasKuchen 11]

I think you have to write:

cd /mod_antiloris-0.4

Instead of

cd mod_antiloris-0.4/