Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

nginx keeps locking up. I've been being DDOSed for the past couple days now. It's a large POST flood. Well, a mixture between GET and POST. The GET doesn't seem to be effective, and I've put a page in front of the login page so that users have to fill in a CAPTCHA before logging in, to prevent the login flood the user was attempting before. (He's still attempting it, flooding both my login pages). Now he's flooding my page that verifies the CAPTCHA, which is the only thing that's managing to affect it now. I'm not sure why it's affecting my server so well, though. It makes the web server completely unreachable. There seems to be a large delay between requests to the verification page, so I believe what he's doing is simply telling nginx that he's going to send POST data, and then sends it very slowly to hold the connection open. Is there a way I can basically time out the connection in this case?

ALSO, now it's a HEAD flood, which doesn't seem to be having any effect whatsoever. Watching all these connections fly by on my terminal.

EDIT: Yup, now I know it's a slow HTTP request attack. Some of these requests are 30k bytes just to login or to submit a CAPTCHA. nginx is taking 20-300 seconds to reply to some of them.

EDIT: To expand on that, I'm fairly certain it's a slow POST flood.

share|improve this question
add comment

1 Answer

Have you tried turning off Keepalives in nginx ? OR at least tuned parameters. Defaults are higher.

keepalive_timeout       30 30;
send_timeout            60; 
keepalive_requests      20;

Also try slowing them down

** Also give a shot to limits limits

limit_req_zone  $binary_remote_addr  zone=blacklist:1m   rate=60r/m;
share|improve this answer
    
What's the difference between binary_remote_addr and remote_addr? I searched a bit, but couldn't find it. Also, the connection passes through a reverse proxy, so REMOTE_ADDR contains the proxy's IP. –  Rob Feb 27 '12 at 8:21
    
consult wiki.nginx.org/HttpLimitZoneModule for binary_remote_addr explanation and as for reverse proxy situation, you could use RealIP module to get the client IP in the nginx. It's about X-Forwarded-for header –  kaji Feb 27 '12 at 8:27
    
X-REAL-IP says that it needs to come from a local IP. unfortunately, my backend server is not on the same internal network as my load balancing system. –  Rob Feb 27 '12 at 8:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.