Re: Mitigating the Slowloris DoS attack

2009-06-24 Thread Andreas Krennmair
* Joe Orton [2009-06-24 11:20]: Meh. There will always be a maximum to the number of concurrent connections a server can handle - be that hardware, kernel, or server design. If you allow a single client to establish that number of connections it will deny service to other clients. That is

Re: Mitigating the Slowloris DoS attack

2009-06-21 Thread Andreas Krennmair
* Guenter Knauf [2009-06-22 04:30]: wouldnt limiting the number of simultanous connections from one IP already help? F.e. something like: http://gpl.net.ua/modipcount/downloads.html Not only would this be futile against the Slowloris attack (imagine n connections from n hosts instead of n con

Mitigating the Slowloris DoS attack

2009-06-21 Thread Andreas Krennmair
Hello everyone, Previously, I had contacted the Apache Security Team about a possible mitigation of the Slowloris DoS attack. I was referred to this mailing list to discuss non-private security issues. For those who are still unaware of the Slowloris attack, it's a denial-of-service attack t

htpasswd salt generation weakness in MD5 mode

2004-09-26 Thread Andreas Krennmair
$ cat /tmp/htpasswdtest2 b:$apr1$iOJN8Jax$rQLDvG0ALByOBtHgN2wk7/ $ Regards, Andreas Krennmair