Stop Slow Loris Attacks

Slow Loris is a low-and-slow denial-of-service technique. An attacker opens many HTTP connections and sends headers one at a time with long delays, keeping each socket occupied until the server runs out of available connections. Legitimate users then get queued or dropped entirely. The good news is that Apache’s mod_qos module can detect and close those stalled connections without you having to write custom WAF rules.

📎 Download noloris.sh

mod_qos Configuration

The following directives go inside your Apache virtual host or server config. They set minimum data rates, cap connections per IP, and block clients that repeatedly trigger error statuses.

<IfModule mod_qos.c>
    QS_SrvMaxConnExcludeIP
    QS_SrvMinDataRate 80 400
    QS_SrvMaxConnClose 180
    QS_SrvMaxConnPerIP 50
    #MaxClients 150
    QS_ClientEventBlockCount 20 300
    QS_SetEnvIfStatus 400 QS_Block
    QS_SetEnvIfStatus 401 QS_Block
    QS_SetEnvIfStatus 403 QS_Block
    QS_SetEnvIfStatus 404 QS_Block
    QS_SetEnvIfStatus 405 QS_Block
    QS_SetEnvIfStatus 406 QS_Block
    QS_SetEnvIfStatus 408 QS_Block
    QS_SetEnvIfStatus 411 QS_Block
    QS_SetEnvIfStatus 413 QS_Block
    QS_SetEnvIfStatus 414 QS_Block
    QS_SetEnvIfStatus 417 QS_Block
    QS_SetEnvIfStatus 500 QS_Block
    QS_SetEnvIfStatus 503 QS_Block
    QS_SetEnvIfStatus 505 QS_Block
    QS_SetEnvIfStatus QS_SrvMinDataRate QS_Block
    QS_SetEnvIfStatus NullConnection QS_Block
    QS_SetEnvIf QS_Whitelist QS_Block !QS_Block
</IfModule>

LoadModule qos_module modules/mod_qos.so

Installing mod_qos

If mod_qos is not already present on the server, build and install it from source:

wget http://sourceforge.net/projects/mod-qos/files/latest/download
tar xzf mod_qos-10.9.tar.gz
cd mod_qos-10.9
cd apache2
apxs -c -i mod_qos.c

SlowLoris and Floods with QoS (Non-Scripted)

The configuration above handles both scripted Slow Loris attempts and unscripted connection floods. QS_SrvMinDataRate enforces a minimum bytes-per-second threshold, so any connection that trickles data below that rate is closed. QS_SrvMaxConnPerIP and QS_ClientEventBlockCount add a second layer by limiting how many simultaneous connections a single IP can hold and how many error events it can trigger before being blocked outright.

• Security
• SysAdmin

• SysAdmin
• Bash