Topic: Can mod_reqtimeout mitigate against slowloris?

[maskego]

I find an post there at asf.https://issues.apache.org/bugzilla/show_bug.cgi?id=51103

Does it mean that mod_reqtimeout for apache 2.4 can't stop the slowloris attack if I don't install mod_antiloris module either?

[James Blond]

Did you read all the answers? It is already in apache 2.4 and in 2.2 since 2.2.20
As far as I understood that it is only about the logging now.

[maskego]

I look that post,but it seems inexplicit.I post this to make confirm.

As far as I know.the mod_antiloris is the only to mitigate slowloris.

[glsmith]

Well, let's look at what the module does and how Slowloris works.

Slowloris opens a lot of connections and never completes the request, so the server sits there waiting for it to complete.

mod_reqtimeout doesn't care if a request ever gets complete, after so much time it will just time out. You set it with a base ammount of time to wait before closing the connection. You can set it short because you also tell it to give more time as more of the request comes in (to handle slow clients on slow connections without cutting them off).

So yes, in a way it does guard against slowloris. The one thing it doesn't do is limit the number of connections. So on Windows versions that have that ugly connection limit (all non-server versions), slowloris could still use them all up. But if the timeouts are set low enough, they may not be able to fill up.

mod_reqtimeout also handles the other side of the equation, the response. Like the request side, if the response doesn't complete soon enough, the connection is closed. Same thing applies, as more of the response is sent, more time is allotted for it to finish.

Even with mod_reqtimeout, I wouldn't get rid of mod_antiloris. I use both.