Karl Katzke

Not sure where the DoS fud is coming from. No webserver can handle a heavy enough DoS attack out of the box, and I don’t see anywhere where I made that claim. Scott added that big “DDoS” disclaimer well after I wrote my post.

I was concerned mainly with this line: “Unfortunately, the application was still trying to map these query strings to blog posts, and the result took my blog down.”

Apache routes, by default, spurious requests for files that do not exist to the bitbucket. The same querystring that he posted as an example of his attack would receive a very quick 404 and Apache moves on and goes about it’s business. Even if a more detailed attack was written that specifically reloaded specific files on my site over and over, I’m running a cache behind the scenes that makes it (again) a fast operation to check the request against a list of possible valid requests and 404 any invalid requests. About the only thing that someone could do to DoS my current Wordpress setup would be to submit spam comments over and over, which could load down the database a bit, but I’d probably just jump in real quick from console and flip a bit in Wordpress to shut off commenting — and Bam!, I’m back online.

Look at the apache default ruleset sometimes - it starts by denying everything and adds exceptions for things that specifically exist. My experience with the IIS default ruleset is that it accepts everything, which is why you need complicated filters like URLScan.

Sebastien, I’ve got at most a basic understanding of IIS configuration, so I’m certainly not qualified to discuss the merits of versions and advantages/disadvantages when making a choice.

How is comparing Apache and IIS irrelevant? That’s what my post did — compare Apache’s way of securing things to IIS’s way of securing things. IIS needs a complicated rule filtering add-on and you still can get DDoS’d by a botnet, which sucks. Apache doesn’t need complicated rule filtering add-on and it’s difficult to get DDoS’d by a botnet unless the attack is specifically targeted at a weakness in your particular configuration.

And mod_rewrite’s been included with most distributions of Apache since god knows when. Your point?

Rob, if you think this post is gnarly you should see what I’ve said about certain Linux tools. I’ve had enough experience with Windows administration that I don’t really care to gain more — my roommate is a Windows admin, and we chat enough about work to cover the basics. He’s actually refused to talk about things recently since the conversations usually go something like, “I had to install OWA with SSL support today, and it took me a few hours.” “Oh? I typed `yum install horde` and it worked.”