DoS/Brute Force [Not Directly IDP Related]

[Tom Poage]

I've seen examples with mod_reqtimeout (ReadRequestTimeout) suggesting it could help mitigate DDoS; mod_security could be configured for something similar, though IMO the former is a bit more straightforward.

Tom.

On Aug 23, 2017, at 1:55 AM, Glenn Wearen <glenn.wearen at heanet.ie<mailto:glenn.wearen at heanet.ie>> wrote:


We put modsecurity on our Apache hosts (that front the IdP), it will offer a degree of DoS protection but not enough for DDoS. Modsec has been particularly useful through blacklisting any URL other than the IdP's known URL's.  This allows us to use 404's in our failonstatus apache proxy settings, which the Tomcat will sometimes return in if the IdP app has crashed (usually triggered by underlying problem with database, ldap, filesysystem etc and not the app).

It also helps with zero day vulnerabilities, not that we've ever had to use it :-)

Regards

Glenn

On 22/08/2017 21:23, Joshua Brodie wrote:
Not directly Shibboleth related.....but there is no better audience than this user group, I will live with taking the risk of posting off topic.

Assuming you don't have a big budget -- and no infrastructure defenses -- beyond bare bones firewall -- how would you protect the IdP from a DoS type attack...

We have had brute force attacks -- which become DoS events due to the load....are thinking of implementing Fail2Ban (it won't protect against DoS but at least we will be alerted and can mitigate brute force by shutting down the IP on the server level -- the upstream firewall will only kick in after a few hours due to manual update by external vendor).

Any other thoughts?



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170823/e917ec5a/attachment-0001.html>