Hi Tomasz, Thanks for your prompt reply. I could not test the configurations yet, but I've extracted the information in a simple document below. If you think its correct, you can update it on jabberd2 wiki.
Configurations in Jabberd2 which implement XEP-0205 to prevent DOS attacks (Ref : http://xmpp.org/extensions/xep-0205.html#rec ) :- In XEP-0205, there are 9 recommendations for preventing XMPP DOS attacks - 4.1 to 4.9. Listed below is Jabberd2 behaviour for each of them. 4.1. Simultaneous Connections not implemented 4.2. Connection Attempts In c2s.xml, maximum connection attempts from a client per second can be controlled using following configuration in the <limits> section: <connects seconds='Y' throttle='Z'>X</connects> If more than X connects are attempted from a single IP in Y seconds, that IP is throttled for Z seconds. Default Y is 5, default Z is 5. set X to 0 to disable. By default it is disabled. 4.3. Unauthenticated Connections This is permanent behaviour - no configuration. 4.4. Simultaneous Resources not implemented 4.5. Stanza Size In c2s.xml, the maximum stanza size can be defined using following configuration in <limits> section : <stanzasize>65535</stanzasize> If more than given number of bytes are read in one incoming stanza, the stream is closed with policy-violation error. Set to 0 to disable. Values less than 16384 might not work. 4.6. Multiple Recipients not implemented 4.7. Bandwidth Limits In c2s.xml, the maximum bytes per second from a client can be configured as follows in the <limits> section : <bytes seconds='Y' throttle='Z'>X</bytes> If more than X bytes are sent in Y seconds, connection is throttled for Z seconds. Default Y is 1, default Z is 5. set X to 0 to disable. By default it is disabled. 4.8. Stanza Limits In c2s.xml, the maximum number of stanzas per second per client can be configured in <limits> section like : <stanzas seconds='Y' throttle='Z'>X</stanzas> If more than X stanzas are sent in Y seconds, connection is throttled for Z seconds. Default Y 1, default Z is 5. Set X to 0 to disable. The default value is 1000 stanzas in 1 second. 4.9. Service Restrictions Service restrictions can be used to control features which cause traffic amplification like muc, pub-uub etc. The configuration is little bit involved and needs some trials to figure out. On Thu, Jan 24, 2013 at 3:44 PM, Tomasz Sterna <[email protected]> wrote: > Dnia 2013-01-24, Thu o godzinie 12:37 +0530, Amol Kulkarni pisze: > > > XEP-0205 Best Practices to Discourage > > Denial of Service Attacks partial > > > Can anybody provide some more information as to what exactly does > > jabberd2 implement ? > > What are configurations for it? > > 4.1. Simultaneous Connections > not implemented > > 4.2. Connection Attempts > implemented: > https://github.com/jabberd2/jabberd2/blob/master/etc/c2s.xml.dist.in#L252 > > 4.3. Unauthenticated Connections > implemented: > https://github.com/jabberd2/jabberd2/blob/master/c2s/c2s.c#L411 > > 4.4. Simultaneous Resources > not implemented > > 4.5. Stanza Size > implemented: > https://github.com/jabberd2/jabberd2/blob/master/etc/c2s.xml.dist.in#L260 > > 4.6. Multiple Recipients > not implemented > > 4.7. Bandwidth Limits > implemented: > https://github.com/jabberd2/jabberd2/blob/master/etc/c2s.xml.dist.in#L234 > > 4.8. Stanza Limits > implemented: > https://github.com/jabberd2/jabberd2/blob/master/etc/c2s.xml.dist.in#L243 > > 4.9. Service Restrictions > implemented: > https://github.com/jabberd2/jabberd2/blob/master/etc/router-filter.xml.dist.in > > > > -- > Tomasz Sterna :(){ :|:&};: > Instant Messaging Consultant Open Source Developer > http://tomasz.sterna.tv/ http://www.xiaoka.com/portfolio > > > >
