<IfModule rewrite_module> <IfModule mod_headers> # Reject request when more than 5 ranges in the Range: header. # CVE-2011-3192 # RewriteEngine on RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,4}$|^$) [NC] RewriteRule .* - [F]
# We always drop Request-Range; as this is a legacy # dating back to MSIE3 and Netscape 2 and 3. # RequestHeader unset Request-Range </IfModule> </IfModule>
# maximum number of active TCP connections is limited to 896 (limited # by the available memory, adjust the settings according to the used # hardware): MaxClients 400
# idle timeout: Timeout 20
# keep alive (for up to 85% of all connections): KeepAlive on MaxKeepAliveRequests 60 KeepAliveTimeout 3 QS_SrvMaxConnClose 85%
# name of the HTTP response header which marks preferred clients (this # may be used to let the application decide which clients are "good" and # have higher privileges, e.g. authenticated users. you may also use # the QS_VipUser directive when using an Apache authentication module such # as mod_auth_basic or mod_auth_oid): QS_VipIPHeaderName mod-qos-login
# enables the known client prefer mode (server allows new TCP connections # from known/good clients only when is has more than 716 open TCP connections): QS_ClientPrefer 80
# minimum request/response speed (deny slow clients blocking the server, # e.g. defending slowloris) if the server has 500 or more open connections: QS_SrvMinDataRate 120 1500 500
# and limit request line, header and body: LimitRequestLine 7168 LimitRequestFields 30 QS_LimitRequestBody 102400
# don't allow more than 30 TCP connections per client source address if # 500 connections are open to the server: QS_SrvMaxConnPerIP 30 500
Copyright：
Copyright is owned by the author. For commercial reprints, please contact the author for authorization. For non-commercial reprints, please indicate the source.
