<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><tt>We put </tt><tt>modsecurity on our A</tt><tt>pache hosts</tt><tt>
(</tt><tt>that fro</tt><tt>nt the IdP), it will </tt><tt>offer
a degree</tt><tt> of DoS protection but not enough</tt><tt> for
DDoS</tt><tt>.</tt><tt> Modsec has been </tt><tt>particularly</tt><tt>
usef</tt><tt>ul </tt><tt>thr</tt><tt>ough</tt><tt> blacklisting
any URL other than the IdP's known URL's. This allows us to use
404's in our failonstatus apache proxy settings, which the
Tomcat will sometimes return in if the IdP app has crashed
(usually triggered by underlying problem with database, ldap,
filesysystem etc and not the app).</tt></p>
<p><tt>It also helps with zero day vulnerabilities, not that we've
ever had to use it :-)</tt></p>
<p><tt>Regards</tt></p>
<p><tt>Glenn</tt><br>
</p>
<div class="moz-cite-prefix">On 22/08/2017 21:23, Joshua Brodie
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAO-t1wGgV7Cq=PFVytOvBxXLzhB1KFbe2FJcdScySMb04sv_vw@mail.gmail.com">
<div dir="ltr">
<div>
<div>
<div>Not directly Shibboleth related.....but there is no
better audience than this user group, I will live with
taking the risk of posting off topic.<br>
<br>
</div>
Assuming you don't have a big budget -- and no
infrastructure defenses -- beyond bare bones firewall -- how
would you protect the IdP from a DoS type attack...<br>
<br>
</div>
We have had brute force attacks -- which become DoS events due
to the load....are thinking of implementing Fail2Ban (it won't
protect against DoS but at least we will be alerted and can
mitigate brute force by shutting down the IP on the server
level -- the upstream firewall will only kick in after a few
hours due to manual update by external vendor).<br>
<br>
</div>
Any other thoughts?<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>