Created attachment 430079 [details]
Patch to backport mod_reqtimeout
Description of problem:
The slowloris attack seems to be gaining popularity and there is a real need to mitigate against this type of attack in httpd. The RHEL httpd is susceptible to a slowloris attack and there is little that can be done to prevent it.
Version-Release number of selected component (if applicable): httpd-2.2.3-43
How reproducible: Always
Steps to Reproduce:
1. Download slowloris
2. Follow the instructions
(I don't really want to post detailed instructions here, but they
are available if you want them.)
It is embarrassingly easy to completely snarl up an httpd server.
httpd continues to work properly
The attached patch backports mod_reqtimeout from httpd 2.2.15. The bulk of
of the changes are just to roll in documentation and the module itself ports
without any trouble at all. Once you have this then you can this in, say,
LoadModule reqtimeout_module modules/mod_reqtimeout.so
RequestReadTimeout header=10 body=30
The actual parameters might need tweaking for some environments, but having
this did completely stop slowloris on my test machine.
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.
^#%$@ bugbot - fixing flags ...
See bug 508238 for discussion of "slowloris" and how to mitigate this type of attack.
mod_reqtimeout in current 2.2.x releases had some significant bugs; there is a significant improvement in the version slated for inclusion in 2.2.17 though currently lacking review upstream.
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.