Hosting Talk | Web Hosting talk India

Web Hosting   Add Host and Hosting News 

 

Go Back   Hosting Talk | Web Hosting talk India > Web Hosting Main Forums > Hosting Security and Technology > Hosting Security and Technology Tutorials

Ads

Reply
 
Thread Tools Display Modes
  #1  
Old 06-22-2012, 12:06 PM
bullten bullten is offline
Junior Member
 
Join Date: Jun 2012
Posts: 12
Default Mitigate Effect of Slowloris Attack

What Is SlowIris Attack:-

In considering the ramifications of a slow denial of service attack against particular services, rather than flooding networks, a concept emerged that would allow a single machine to take down another machine’s web server with minimal bandwidth and side effects on unrelated services and ports. The ideal situation for many denial of service attacks is where all other services remain intact but the webserver itself is completely inaccessible. Slowloris was born from this concept, and is therefore relatively very stealthy compared to most flooding tools.

Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way web servers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they’ll allow. Slowloris must wait for all the sockets to become available before it’s successful at consuming them, so if it’s a high traffic website, it may take a while for the site to free up it’s sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they’ll still be able to see the site. So it’s a bit of a race condition, but one that Slowloris will eventually always win – and sooner than later.

Web Server Vulnerable To This Attack:-
Quote:
Apache 1.x
Apache 2.x
dhttpd
GoAhead WebServer
Web Server Not Vulnerable To This Attack:-

Quote:
IIS6.0
IIS7.0
lighttpd
Squid
nginx
Cherokee
Netscaler
Cisco CSS
As we can see apache is vulnerable to this attack so we will take some precaution to mitigate its affect.We will use mod_antiloris to protect Apache server

What Is The Use Of Mod_Antiloris ?

With mod_antiloris module, apache is protected against the slowloris attack. The module limits the number of threads in READ state on a per IP basis.

How To Install Mod_Antiloris?

1) Download the installer from sourceforge and install

Quote:
a) cd /usr/local/src
b) wget Download mod_antiloris from SourceForge.net
c) tar -xvjf mod_antiloris-0.4.tar.bz2
d) cd mod_antiloris-*
e) apxs -a -i -c mod_antiloris.c
2) Now we have to restart apache

Code:
service httpd restart
3) How to check whether mod_antiloris loaded or not

Code:
httpd -M | grep antiloris
Note if you are using cpanel server then you have to run the below command to make sure new modification are updated into configuration system file

Code:
/usr/local/cpanel/bin/apache_conf_distiller –update
Now you can check if your Apache is protected from Slowloris Dos attack or not . Launch a slowloris attack and check Apache status page to see if its effecting it or not.

Article Source: Install mod_antiloris
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 02:42 PM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2018, SEO by YABBSEO 1.0 2012, YABSoft.com.