DoS/Brute Force [Not Directly IDP Related]

[Glenn Wearen]

We put modsecurity on our Apache hosts(that front the IdP), it will 
offer a degreeof DoS protection but not enoughfor DDoS.Modsec has been 
particularlyuseful throughblacklisting any URL other than the IdP's 
known URL's.  This allows us to use 404's in our failonstatus apache 
proxy settings, which the Tomcat will sometimes return in if the IdP app 
has crashed (usually triggered by underlying problem with database, 
ldap, filesysystem etc and not the app).

It also helps with zero day vulnerabilities, not that we've ever had to 
use it :-)

Regards

Glenn

On 22/08/2017 21:23, Joshua Brodie wrote:
> Not directly Shibboleth related.....but there is no better audience 
> than this user group, I will live with taking the risk of posting off 
> topic.
>
> Assuming you don't have a big budget -- and no infrastructure defenses 
> -- beyond bare bones firewall -- how would you protect the IdP from a 
> DoS type attack...
>
> We have had brute force attacks -- which become DoS events due to the 
> load....are thinking of implementing Fail2Ban (it won't protect 
> against DoS but at least we will be alerted and can mitigate brute 
> force by shutting down the IP on the server level -- the upstream 
> firewall will only kick in after a few hours due to manual update by 
> external vendor).
>
> Any other thoughts?
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170823/3171582a/attachment-0001.html>