Project

General

Profile

How to prevent from attack with high frequent file downloads?

Added by Richard Rauch over 10 years ago

Hi all,

I have a problem right now. Our Redmine server was not working stable for some days. Today the Redmine server sevices stops already a few minutes after restarting them.
Now I found out, that a huge file was accessed from an external IP address frequently each seconds, not awaiting the completion of file download. As result, the memory consumption exceeded server limits and the services chrashed.
In normal operation, download of this file would need a few minutes (500 MByte).
It looks like an attack, because this IP address is accessing this file frequently the whole day.

Now we blocked this address and our server is working stable again. But this is only a tempory solution. Such an attempt could occur again (by accident or wilfully).

Is it possible to restrict the maximum number of currently active file accesses? Such a restriction should deny further accesses, but should not shutdown the Redmine services.

Thanks
Richard