Re: DOS?

On Sun, Sep 27, 2009 at 18:37, Chris Wells <clwells@nexcess.net> wrote: > > Lots of "pattern=test" lookups - enough to tax the server pretty severely. >  Not sure if anyone else is seeing this but I edited the 'manual-lookup..php' > to filter out these requests for now and things calmed down immediately. I also forgot to mention: editing that file will only have a temporary effect. When your mirror is synchronized again, the rsync diff will cause it to be updated and overwritten on your mirrors. A more permanent and economical fix (locally) would be to edit your Apache configuration to block that particular request at the server side. Moreover than that would be to utilize an automated firewall-modification script --- even just automated iptables chains. Anything over xxx requests per minute is banned for xx(...) minutes. For example, for throttling a mirror, you may want to have it set to drop all connections from an IP when the number of connections exceeds 120 per minute (2 per second), and maintain the effect of that rule for 360 minutes (6 hours). -- </Daniel P. Brown> daniel.brown@parasane.net || danbrown@php.net http://www.parasane.net/ || http://www.pilotpig.net/