Re: [users@httpd] Re: apache service interruption

2013-07-30 Thread Grant
You wouldn't keep a syn proxy rule enabled all the time; only under a DoS attack. You could also implement ModSecurity. ModSecurity looks good and I think it works with nginx as well as apache. Is everyone who isn't running OSSEC HIDS or ModSecurity vulnerable to a single client requesting

Re: [users@httpd] Re: apache service interruption

2013-07-30 Thread Michael D. Wood
Two different things come to mind. Kingcope found an Apache byterange vulnerability and the PoC code he wrote for it exhausts the resources on a server running Apache. Only 1 instance of his perl script had to be ran. LOIC is another that could possible DoS your server from one source.

Re: [users@httpd] Re: apache service interruption

2013-07-30 Thread Pete Houston
On Mon, Jul 29, 2013 at 11:25:26PM -0700, Grant wrote: ModSecurity looks good and I think it works with nginx as well as apache. Is everyone who isn't running OSSEC HIDS or ModSecurity vulnerable to a single client requesting too many pages and interrupting the service? Not everyone, no.

Re: [users@httpd] concerns about requirements for Apache 2.4.6 release

2013-07-30 Thread Rainer Jung
On 30.07.2013 05:08, Dennis Clarke wrote: I'm a bit confused about the requirements for Apache 2.4.6. This page seems very clear : http://www.apache.org/dist/httpd/Announcement2.4.html There is states that This release requires the Apache Portable Runtime (APR) version 1.4.x and

Re: [users@httpd] concerns about requirements for Apache 2.4.6 release

2013-07-30 Thread Rainer Jung
On 30.07.2013 10:27, Rainer Jung wrote: On 30.07.2013 05:08, Dennis Clarke wrote: I'm a bit confused about the requirements for Apache 2.4.6. This page seems very clear : http://www.apache.org/dist/httpd/Announcement2.4.html There is states that This release requires the Apache

Re: [users@httpd] concerns about requirements for Apache 2.4.6 release

2013-07-30 Thread Dennis Clarke
On 30/07/13 07:46 AM, Rainer Jung wrote: On 30.07.2013 10:27, Rainer Jung wrote: On 30.07.2013 05:08, Dennis Clarke wrote: I'm a bit confused about the requirements for Apache 2.4.6. This page seems very clear : http://www.apache.org/dist/httpd/Announcement2.4.html There is states that

Re: [users@httpd] concerns about requirements for Apache 2.4.6 release

2013-07-30 Thread Rainer Jung
On 30.07.2013 16:13, Dennis Clarke wrote: Not to be a completely obsessive compulsive nit pick, but being OCD helps greatly when writing software. Any chance we could fix the typo? - Higher performant shm-based cache implementation Probably should be performance there. dc ps:

[users@httpd] How to make Alias work even when omitting the slash

2013-07-30 Thread Mai Nakagawa
Hi, Could you tell me how to make Alias work when omitting the trailing slash? There is the following description in this article: http://developer.yahoo.com/blogs/ydn/high-performance-sites-rule-11-avoid-redirects-7209.html For example, going to http://astrology.yahoo.com/astrology results in