What techniques and/or modules are available to implement robust rate limiting (requests|bytes/ip/unit time) in apache?
Join Stack Overflow to learn, share knowledge, and build your career.
|
|
The best
and the rest |
|||||||||||||||||||||
|
|
There are numerous way including web application firewalls but the easiest thing to implement if using an Apache mod. One such mod I like to recommend is mod_qos. It's a free module that is veryf effective against certin DOS, Bruteforce and Slowloris type attacks. This will ease up your server load quite a bit. It is very powerful. The current release of the mod_qos module implements control mechanisms to manage:
This is a sample config of what you can use it for. There are hundreds of possible configurations to suit your needs. Visit the site for more info on controls.
|
|||||
|
|
Sadly, |
||||
|
|
|
As stated in this blog post it seems possible to use Apache's mod_security to implement a rate limit per second. The configuration is something like this:
|
|||||||||||||
|
|
One more option - mod_qos Not simple to configure - but powerful. |
|||
|
|
|
In Apache 2.4, there's a new stock module called mod_ratelimit. For emulating modem speeds, you can use mod_dialup. Though I don't see why you just couldn't use mod_ratelimit for everything. |
|||||
|