Difference between revisions of "HIDS 31102"

From Atomicorp Wiki
Jump to: navigation, search
m (Description)
m (Tuning Guidance)
 
(3 intermediate revisions by one user not shown)
Line 9: Line 9:
 
= Description =
 
= Description =
  
This rule is triggered when a a single IP has opened too many connections to the apache webserver in a READ state.  This condition is unusual for a normal client, and occurs when either an attacker is trying to use up all the threads on the server to prevent it from servicing any other clients (Denial of Service Attack) or if your clients really need to open an unusually high number of READ connections.   
+
This rule is triggered when a a single IP has opened too many connections to the apache webserver in a READ state.  This condition is unusual for a normal client, and occurs when either an attacker is trying to use up all the threads on the server to prevent it from servicing any other clients (Denial of Service Attack) or if a single IP needs to open an unusually high number of READ connections.   
  
This alert will occur when a slowloris attack is occurring.
+
This alert will also occur when a slowloris attack is occurring.
  
 
This rule reports when apache has stopped accepting READ requests from a client.  You can configure this limit by following the Tuning Guidance below.
 
This rule reports when apache has stopped accepting READ requests from a client.  You can configure this limit by following the Tuning Guidance below.
Line 25: Line 25:
 
The rule alerts when the configured WAF_READSTATELIMIT value is exceeded.  The rule does not cause this event to occur, it just reports when it occurs.   
 
The rule alerts when the configured WAF_READSTATELIMIT value is exceeded.  The rule does not cause this event to occur, it just reports when it occurs.   
  
'''Disabling this rule will not prevent this event from occurring''', it will just prevent ASL from alerting you that this is occurring, and optionally from shunning the IP address that is causing this event
+
'''Disabling this rule will not prevent this event from occurring''', it will just prevent ASL from alerting you that this is occurring.
  
 
We do not recommend you disable this rule.  If you do not wish to shun on this rule, just change the Rules configuration for Active Response to "no".  See below for tuning guidance if the default READ state limit is too low for your system.
 
We do not recommend you disable this rule.  If you do not wish to shun on this rule, just change the Rules configuration for Active Response to "no".  See below for tuning guidance if the default READ state limit is too low for your system.
Line 35: Line 35:
 
https://www.atomicorp.com/wiki/index.php/ASL_WAF#WAF_READSTATELIMIT
 
https://www.atomicorp.com/wiki/index.php/ASL_WAF#WAF_READSTATELIMIT
  
We do not recommend you change this setting unless you know what you are doing.  The default should be sufficient for even very large systems, and increasing this limit may make your system vulnerable to slowloris attacks.  Setting this too low may cause legitimate clients from being able to connect to your system.
+
Increasing this limit may make your system vulnerable to slowloris attacks.  Setting this too low may cause legitimate clients from being able to connect to your system.
  
 
= Additional Information =
 
= Additional Information =
Line 46: Line 46:
  
 
None.
 
None.
 +
 +
== Notes ==
 +
 +
The default limit in ASL3 is 10, the default limit in ASL4 is 100.  ASL4 contains additional safeguards against Denial of Service attacks and can safely allow a higher limit without a decrease in protection.
  
 
== Outside References ==  
 
== Outside References ==  
  
 
None.
 
None.

Latest revision as of 11:23, 25 January 2014

Rule 31102
Status Active
Alert Message ModSecurity: Access denied with code 400. Too many threads

Contents

[edit] Description

This rule is triggered when a a single IP has opened too many connections to the apache webserver in a READ state. This condition is unusual for a normal client, and occurs when either an attacker is trying to use up all the threads on the server to prevent it from servicing any other clients (Denial of Service Attack) or if a single IP needs to open an unusually high number of READ connections.

This alert will also occur when a slowloris attack is occurring.

This rule reports when apache has stopped accepting READ requests from a client. You can configure this limit by following the Tuning Guidance below.

[edit] Log example

[warn] ModSecurity: Access denied with code 400. Too many threads [11] of 10 allowed in READ state from 1.2.3.4 - Possible DoS Consumption Attack [Rejected

[edit] Troubleshooting

[edit] False Positives

The rule alerts when the configured WAF_READSTATELIMIT value is exceeded. The rule does not cause this event to occur, it just reports when it occurs.

Disabling this rule will not prevent this event from occurring, it will just prevent ASL from alerting you that this is occurring.

We do not recommend you disable this rule. If you do not wish to shun on this rule, just change the Rules configuration for Active Response to "no". See below for tuning guidance if the default READ state limit is too low for your system.

[edit] Tuning Guidance

This limit is configured by this setting:

https://www.atomicorp.com/wiki/index.php/ASL_WAF#WAF_READSTATELIMIT

Increasing this limit may make your system vulnerable to slowloris attacks. Setting this too low may cause legitimate clients from being able to connect to your system.

[edit] Additional Information

[edit] Similar Rules

None.

[edit] Knowledge Base Articles

None.

[edit] Notes

The default limit in ASL3 is 10, the default limit in ASL4 is 100. ASL4 contains additional safeguards against Denial of Service attacks and can safely allow a higher limit without a decrease in protection.

[edit] Outside References

None.

Personal tools