Bug 612198
| Summary: | RFE: add mod_reqtimeout to mitigate against slowloris attack | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | john.haxby <john.haxby> | ||||
| Component: | httpd | Assignee: | Joe Orton <jorton> | ||||
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.5 | CC: | ddumas | ||||
| Target Milestone: | rc | Keywords: | FutureFeature | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Enhancement | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 676634 (view as bug list) | Environment: | |||||
| Last Closed: | 2011-07-21 08:54:05 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. ^#%$@ bugbot - fixing flags ... See bug 508238 for discussion of "slowloris" and how to mitigate this type of attack. mod_reqtimeout in current 2.2.x releases had some significant bugs; there is a significant improvement in the version slated for inclusion in 2.2.17 though currently lacking review upstream. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-1067.html An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-1067.html |
Created attachment 430079 [details] Patch to backport mod_reqtimeout Description of problem: The slowloris attack seems to be gaining popularity and there is a real need to mitigate against this type of attack in httpd. The RHEL httpd is susceptible to a slowloris attack and there is little that can be done to prevent it. Version-Release number of selected component (if applicable): httpd-2.2.3-43 How reproducible: Always Steps to Reproduce: 1. Download slowloris 2. Follow the instructions (I don't really want to post detailed instructions here, but they are available if you want them.) Actual results: It is embarrassingly easy to completely snarl up an httpd server. Expected results: httpd continues to work properly Additional info: The attached patch backports mod_reqtimeout from httpd 2.2.15. The bulk of of the changes are just to roll in documentation and the module itself ports without any trouble at all. Once you have this then you can this in, say, /etc/httpd/conf.d/reqtimeout.conf: LoadModule reqtimeout_module modules/mod_reqtimeout.so RequestReadTimeout header=10 body=30 The actual parameters might need tweaking for some environments, but having this did completely stop slowloris on my test machine.