Re: Slow http denial of service

2015-03-16 Thread Robert Klemme
On Sun, Mar 15, 2015 at 10:07 AM, Aurélien Terrestris wrote: > I agree with the NIO connector which gives good results to this > problem. Also, on Linux you can configure iptables firewall to limit > the number of connections from one IP ( > > http://unix.stackexchange.com/questions/139285/limit-

Re: Maximum number of JSP ?

2014-05-05 Thread Robert Klemme
Hi Sylvain, thank you for sharing all these details! On Mon, May 5, 2014 at 3:22 PM, Sylvain Goulmy wrote: > Hi Christopher, > > Thank you for your contribution to this thread. I think we we have made > good progress on the subject, here are some elements i'd like to share : > - The fact that t

Re: Maximum number of JSP ?

2014-04-11 Thread Robert Klemme
On Fri, Apr 11, 2014 at 5:35 PM, Mikolaj Rydzewski wrote: > On 11.04.2014 17:22, Robert Klemme wrote: > >> JSP _is_ a templating mechnism. In what way do you expect another >> templating mechanism to help here? All the strings (among other stuff) >> need to be stored so

Re: Maximum number of JSP ?

2014-04-11 Thread Robert Klemme
On Fri, Apr 11, 2014 at 3:41 PM, Mikolaj Rydzewski wrote: > On 11.04.2014 15:31, André Warnier wrote: > >> As far as I first understand such things, each of these JSP's gets >> compiled into a servlet, and the code of that servlet is held in >> memory for an extended period of time, even if unused

Re: [OT] HeartBleed bug

2014-04-09 Thread Robert Klemme
On Wed, Apr 9, 2014 at 2:53 PM, Christopher Schultz wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Ognjen, > > On 4/9/14, 3:30 AM, Ognjen Blagojevic wrote: >> On 9.4.2014 9:49, André Warnier wrote: >>> I wonder if I may ask this list-OT question to the SSH experts on >>> the list :

Re: Nessus scan claims vulnerability in Tomcat 6

2013-02-26 Thread Robert Klemme
On Tue, Feb 26, 2013 at 4:04 PM, Mark Thomas wrote: > On 26/02/2013 03:09, Robert Klemme wrote: >> So one solution would be to remove APR lib from the system. > > Yes, although you will see performance for SSL drop. Yes, of course. That's not important in

Re: Nessus scan claims vulnerability in Tomcat 6

2013-02-26 Thread Robert Klemme
Hi Mark, thank you for the feedback! On Tue, Feb 26, 2013 at 2:27 AM, Mark Thomas wrote: > On 25/02/2013 08:42, Robert Klemme wrote: >> >> Hi there, >> >> I have been confronted with a Nessus scan result which claims >> vulnerability to exploit "TLS CR

Nessus scan claims vulnerability in Tomcat 6

2013-02-25 Thread Robert Klemme
Hi there, I have been confronted with a Nessus scan result which claims vulnerability to exploit "TLS CRIME". Plugin 62565 allegedly has found this and the report states: "The remote service has one of two configurations that are known to be required for the CRIME attack: - SSL / TLS compression