Too Much requests
We get a lot of requests from the (IP 220.127.116.11 for example) for our Lufi instance, which then crashes our fileexchanger. Only after the IP 18.104.22.168 was locked, Lufi could be started normally again. Without locking the socket crashed immediately after the first request. Maybe do you have an Idea, what we can do?
Currently we run a DoS protection in Apache via mod_evasive , which blocks IPs as soon as an IP
- more than 100 requests per second to the same URL (DOSPageCount) or
- more than 300 requests per second to the same website (DOSSiteCount) take place.
DOSSiteCount cannot be further reduce, otherwise websites with many small requests (e.g. Matomo) will cause unwanted blocks. With DOSPageCount there is certainly still potential. A grep on access.log showed min 44 to max 230 requests per second from the mentioned IP. Actually it should have been blocked already. But /var/log/mod_evasive is empty. I suggest to clarify why the log is empty and as soon as the logging works, reduce the value to 30 and monitor the system.
Another approach would be to write a jail in fail2ban for fileexchanger access.log, which will execute a block on 20 consecutive download attempts and (if necessary) restart the services.