https://bz.apache.org/bugzilla/show_bug.cgi?id=70215
Bug ID: 70215
Summary: mod_ssl docs should mention mod_reqtimeout for
controlling e.g. TLS handshake timeout
Product: Apache httpd-2
Version: 2.4.68
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Documentation
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
I've just wasted about a day trying to mitigate a particularly annoying botnet
scraping attempt.
The behaviour was to not complete the TLS handshake, just sitting there doing
nothing after the server side had sent the certificate. The normal HTTP level
timeouts do nothing about this.
So, naturally I looked at the docs for `mod_ssl`, and found nothing about
timing out a connection if the handshake isn't completed in a timely manner.
I briefly looked at mod_reqtimeout, but only in the Debian package
`mods-available/reqtimeout.conf` file, which has very limited examples, and no
hint about it covering the TLS layer.
So, perhaps a mention in the `mod_ssl` documentation about using
`mod_reqtimeout` in this scenario ?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
