Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash.

I've looked through the logs but can't see anyway to tell the requests apart from a regular visitor who's browser is quickly loading all the components on a busy page.

Any advice would be appreciated.

share|improve this question

migrated from stackoverflow.com Mar 22 '11 at 0:16

This question came from our site for professional and enthusiast programmers.

1  
Oh sorry, I should have said. The only info I've managed to find on Keep-Dead so far is on esrun.co.uk/blog/keep-alive-dos-script . But it contains no hints about how to block it! –  Stevie Mar 21 '11 at 18:02
1  
Pedantic Note: You're never safe. If someone wants to bad enough, they always will be able to get in. Period. –  ircmaxell Mar 21 '11 at 18:04

2 Answers 2

Disable HTTP keep-alive, or install a server that isn't effected by this as a proxy in front of Apache. Nginx would be a good choice here.

This attack appears to be similar to the Slowloris attack, in that it exploits a specific feature of Apache. It's pretty trivial to defend against.

Note: If you install nginx, disable keep-alive on apache, and keep it enabled on nginx.

share|improve this answer
    
Isn't keep alive a pretty important feature? I could understand temporarily disabling it, but permanently? –  TheLQ May 10 '11 at 22:54
    
It may result in slightly longer load times, but it's not like it's going to result in your site failing to load for people. Installing nginx in front is a far better solution. –  devicenull May 11 '11 at 4:29

Keep-Dead works by sending HEAD requests while keeping the TCP connection alive (Keep-Alive, thus the name of the script). That is probably quite distinct from legit requests to your webserver that would probably mostly be POST/GET. Ask your IDS/IPS to detect numerous HEAD requests within a short timespan and do what's appropriate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.