mod_reqtimeout and security

Jani H Rautiainen <jani.rautiainen@xxxxxx> · Fri, 05 Sep 2014 22:07:41 +0300

Hi!

I have set up forward proxy for SSH connection to my box. For a long 

time I was troubleshooting timeout issue which caused the session to 

timeout after 30 seconds. Finally I was able to trace down the issue to 

mod_reqtimeout module. To keep the session alive I need to add the 

following to my virtualhosts conf (and yes, I'm just started to fine 

tune the params):

RequestReadTimeout header=60-3600,MinRate=10

I need to run proxy service either on port 80 or 443 as these are the 

only open ports. These are of course used to serve other content as well.

However the thing I'm now concerned is that what kind of impact this 

RequestReadTimeout setting has to overall security of the server? Is it 

making it more vulnerable to attacks and can something be done to make 

it more secure if needed? And of course, please point if there's a more 

clever solution to keep the sessions alive :-)

Thanks,

Jani

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx