| If you just reply to these hackers, you will be "pinged" until oblivion. I choose to fight, you don't. I have a different philosophy. I log the offenders and if from a colo, VPS, etc., they can enjoy their lifetime ban. Machines are not eyeballs. Drop the map? So do I stop looking for bad referrals and bad user agents as well? Maybe, just maybe, nginx was given these tools to be, well, used. Questions? I really don't have any burning questions since I don't expect to use 444 as rate limiting. My only question was does it actually work in limiting, as the other poster suggested. I assume you have evidence of the CPU cycles used by the map module. I mean, you wouldn't just make stuff up, right? Running uptime, my server peaks at around 0.8, and usually runs between 0.5 to 0.6. I don't see a problem here. Oh, and you can bet those clowns proving for WordPress vulnerabilities today will be employing the next script kiddie to come along in the future.
If you are to quote what you call documentation, please use some real one: http://nginx.org/en/docs/http/request_processing.html#how_to_prevent_undefined_server_names What I said before remains valid: accepting connection, reading request & writing response use resources, by design, even if you thn close the connection. When dealing with DoS, I suspect Web servers and WAF (even worse, trying to transform a Web server in a WAF!) are inefficient compared to lower-level tools. Use tools best suitable to the job... DoS is all about processing capacity vs incoming flow. Augmenting the processing consumption reduces capacity. Issuing simple return costs less than using maps, which in turn is better than processing more stuff. If your little collection sustains your targeted incoming flow then you win, otherwise you lose. Blatantly obvious assertions if you ask me... I do not know what you are trying to achieve here. Neither do you as it seems, or you would not be asking questions about it. Good luck, though. --- B. R. On Tue, Sep 27, 2016 at 9:12 PM, <[email protected]> wrote: If you dig through some old posts, it was established that the deny feature of nginx isn't very effective at limiting network activity. I deny at the firewall. | ||
_______________________________________________ nginx mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx
