This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Denial of Service Cheat Sheet"

From OWASP
Jump to: navigation, search
(NginX secure configuration)
m (Point to the official site)
 
(20 intermediate revisions by 2 users not shown)
Line 2: Line 2:
 
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
 
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
  
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+
The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
= Introduction  =
 
__TOC__{{TOC hidden}}
 
  
This article is focused on providing clear, simple, actionable defense guidance for preventing denial of service in your web applications. Denial of Service attacks are very common due to two factors :
+
Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html Denial of Service Cheat Sheet] to see the latest version of the cheat sheet.
 
 
# The significant prevalence of cloud and web services 
 
# Easy to get testing tools to cause denial of service attacks.
 
 
 
Because it's very simple to launch the DOS attack, any web services don't have Anti-DOS defenses mitigation in place will be vulnerable to DOS attacks.
 
 
 
To avoid and mitigate DOS attack, both developers and operations engineering will need to have layered of defenses in place:
 
 
 
a) Service: When the service is built, it's developed with anti-DOS in mind such Input validation, Resource handling, Size or Length validation.
 
 
 
b) Web Host: Every Web server such Apache, NginX or Linux host provides the configuration of connection. Properly configure these network configuration may also help to mitigate the DOS attacks.
 
 
 
c) Infrastructure: Signature-based or behavior detection firewalls, load balance, fail-over, cloud anti-DDoS service
 
 
 
This objective of the article is to provide a list of common techniques for preventing DOS attack regardless of technology and platforms.
 
 
 
 
 
=Coding Defenses=
 
 
 
 
 
 
 
= Web Services Defenses =
 
General web services protection against DOS can be listed as 3 main category
 
* Max connection per IP address
 
* Max size of every HTTP request
 
* Timeout value of each HTTP request connection
 
 
 
==NginX secure configuration==
 
 
 
=== Connection Timeout ===
 
Define the connection timeout value.
 
client_body_timeout  10;
 
client_header_timeout 10;
 
keepalive_timeout    5 5;
 
keepalive_requests    100;
 
send_timeout          10;
 
 
 
=== Request Size ===
 
Limit the size of http request to mitigate the buffer overflow attack
 
client_body_buffer_size  100K;
 
client_header_buffer_size 1k;
 
client_max_body_size 100k;
 
large_client_header_buffers 2 1k;
 
 
 
=== Max Connection  ===
 
# Connection limit configurations
 
limit_conn ip_limit_zone 64;
 
 
 
http://nginx.org/en/docs/http/ngx_http_core_module.html
 
 
 
 
 
limit_conn and limit_conn_zone
 
 
 
 
 
== Apache secure configuration ==
 
 
 
<nowiki>#</nowiki>Define the general timeout value of every connection.
 
 
 
Timeout 10
 
 
 
http://httpd.apache.org/docs/2.4/mod/core.html#timeout
 
 
 
<nowiki>#</nowiki> Reuses the same TCP port per client connection.
 
 
 
KeepAlive On
 
 
 
<nowiki>#</nowiki>Define the max Http requests connection is allowed per TCP connection.
 
 
 
MaxKeepAliveRequests 100
 
 
 
<nowiki>#</nowiki>Timeout value per connection to free up the server resources.
 
 
 
KeepAliveTimeout 15
 
 
 
http://httpd.apache.org/docs/2.4/mod/core.html#keepalive
 
 
 
<nowiki>#</nowiki>Limit the size of request Body (100K)
 
 
 
LimitRequestBody 102400
 
 
 
http://httpd.apache.org/docs/2.4/mod/core.html#limitrequestbody
 
 
 
= Network Infrastructure Defenses =
 
 
 
=Related Articles=
 
 
 
 
 
= Authors and Primary Editors  =
 
 
 
[[User:Tony_Hsu_HsiangChih|Tony Hsu]] - hsiang_chih[at]yahoo.com<br />
 
 
 
<br />
 
== Other Cheatsheets ==
 
 
 
{{Cheatsheet_Navigation_Body}}
 
 
 
[[Category:Cheatsheets]]
 
[[Category:Popular]]
 

Latest revision as of 14:36, 15 July 2019

Cheatsheets-header.jpg

The Cheat Sheet Series project has been moved to GitHub!

Please visit Denial of Service Cheat Sheet to see the latest version of the cheat sheet.