Mitigating slowloris attack

maestroc

• September 25, 2023 21:02

I am randomly getting slowloris style attacks on my server. Using the info found on here and other places I have determined that the attacks are primarily coming from a large block of IP's in Singapore that all begin with the number 47.128.xx.xx. This started a few days ago and seems to come back every 6-8 hours. I heard about mod_qos but when I try to add it to my easy apache it tells me that it has to uninstall some things that I am unaware of whether it is important or not: The following conflicts are installed on this machine. They will be removed as part of this package selection:

• mod_mpm_prefork
• mod_cgi

The following requirements are not installed on this machine. They will be added as part of this package selection:

• mod-qos
• mod_mpm_worker
• mod_cgid

Do I need to worry about any of this? Or should I just go ahead and install mod_qos? I also see that mod_reqtimeout is also suggested and that one shows no conflicts when I have easy apache review the build. However the docs I have seen about that don't tell me much about configuring it. Do I just build it into apache and it will work out of the box? As a last resort would it be adequate for now to take the easy way and just geo block Singapore since I know I will not be getting any legitimate traffic from there based on my server's content?

• 

  cPRex Jurassic Moderator

  • September 26, 2023 17:43

  Hey there! If you have the range of IP addresses, I'd just block the range in the firewall. That way, no customizations are needed on the server side and you don't have to change your otherwise-working Apache configuration.

  0
• 

  ITHKBO

  • October 06, 2023 12:48

  Here is all the information with regards to the module differences.
  mod_cgi whenever a multi-threaded MPM is selected during the compilation process. At the user level, this module is identical in configuration and operation to They require no additional changes to MPM or cgi so best of both worlds while offering a simular defence. In addition since 2.2.15 Apache itself recommends using mod_reqtimeout.

  0

Please sign in to leave a comment.