| # This configuration is an example of how to use connection tarpitting based |
| # on invalid requests. |
| |
| global |
| daemon |
| log 127.0.0.1 local0 |
| |
| listen frontend 0.0.0.0:80 |
| mode http |
| option httplog |
| log global |
| maxconn 10000 |
| |
| # do not log requests with no data |
| option dontlognull |
| |
| # log as soon as the server starts to respond, an do not wait for the |
| # end of the data transfer. |
| option logasap |
| |
| # disable keep-alive |
| option httpclose |
| |
| # load balancing mode set to round-robin |
| balance roundrobin |
| |
| # the maxconn 150 below means 150 connections maximum will be used |
| # on apache, the remaining ones will be queued. |
| server apache1 127.0.0.1:80 maxconn 150 |
| |
| # use short timeouts for client and server |
| clitimeout 20000 |
| srvtimeout 20000 |
| |
| # the connect timeout should be large because it will also be used |
| # to define the queue timeout and the tarpit timeout. It generally |
| # is a good idea to set it to the same value as both above, and it |
| # will improve performance when dealing with thousands of connections. |
| contimeout 20000 |
| |
| # retry only once when a valid connection fails because the server |
| # is overloaded. |
| retries 1 |
| |
| # You might want to enable this option if the attacks start |
| # targetting valid URLs. |
| # option abortonclose |
| |
| # not needed anymore. |
| #capture request header X-Forwarded-For len 15 |
| |
| # and add a new 'X-Forwarded-For: IP' |
| option forwardfor |
| |
| # how to access the status reporting web interface |
| stats uri /stat |
| stats auth stat:stat |
| |
| # Request header and URI processing begins here. |
| |
| # rename the 'X-Forwarded-For:' header as 'X-Forwarded-For2:' |
| reqirep ^(X-Forwarded-For:)(.*) X-Forwarded-For2:\2 |
| |
| #### Now check the URI for requests we want to tarpit ### |
| # We do not analyze headers, we just focus on the request |
| reqpass ^[^:\ ]*: |
| |
| # Tarpit those URIs for any method |
| reqtarpit ^[^:\ ]*\ /invalid_req1 |
| reqtarpit ^[^:\ ]*\ /cgi-bin/.*\.pl\? |
| reqitarpit ^[^:\ ]*\ /.*\.(dll|exe|asp) |
| |