Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had asked this question on ITSecurity, but I felt this question is better placed here.

On a recent assesment, I found that sending large (>5 MB) requests to a tomcat server causes 100% CPU usage on the server. The simplest fix that came to mind was to use the maxPostSize on the connector. However this did not help since the request I need to send is not "form-url-encoded". I read around to find that the maxPostSize is only applicable to that header.

So, what is the alternate way to stop such large packets right at the server before passing it on to the application ?

In other words: How do I prevent a DoS on a Tomcat server by from an attacker who sends multiple large data requests

share|improve this question
1  
Please do not cross-post. Thank you! –  Mike Pennington Aug 2 '12 at 17:04
add comment

2 Answers

up vote 0 down vote accepted

IF CédricC's answer won't help - use httpd with mod_security as frontend - there you can specify limits for anything...

share|improve this answer
    
Yes, this is the solution I had in mind too. Hopefully, it should not increase the overhead too much. But since the tomcat uses SSL, I need to config httpd to use ssl and have a plain connection between tomcat and apache. –  sudhacker Aug 6 '12 at 13:39
    
I'm using it with old mod_jk - no problems –  GioMac Aug 6 '12 at 20:44
add comment

Which tomcat version are you using? and is the request data in the request parameter?

If it is not one of the last (>6.0.35 or >7.0.23), then it can be because of an hash collision vulnerability from the JVM (see CVE-2012-0022 ).

It is corrected from 6.0.34 and 7.0.23 by adding a maxParameterCount to the connector (defaults to 10000).

http://tomcat.apache.org/tomcat-7.0-doc/config/http.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.