The number of allowed simultaneous requests must be set.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-2240 | WG110 A22 | SV-33018r1_rule | - | medium |
| Description | ||||
| Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive). | ||||
| STIG | Date | |||
| APACHE 2.2 Site for UNIX Security Technical Implementation Guide | 2019-01-07 | |||
Details
Check Text (C-33018r1_chk)
To view the MaxKeepAliveRequests value, enter the following command:
grep "MaxKeepAliveRequests" /usr/local/apache2/conf/httpd.conf
If the returned value of MaxKeepAliveRequests is not set to 100 or greater, this is a finding.
Fix Text (F-29334r1_fix)
Edit the httpd.conf file and set the MaxKeepAliveRequests directive to 100 or greater.