再见阿郎

Nginx防慢连接攻击实战：几行配置挡住Slowloris_我的网站

一 |     

　    一键部署OpenClaw        做站长最怕的不是没流量，是服务器莫名其妙瘫了。Slowloris 这类慢连接攻击不发送大量请求，而是故意把连接拖住，耗光 Nginx 的 worker 进程。你的网站可能瞬间从“打不开”变成完全无响应。    

         应对思路很简单：给连接设置合理的超时阈值。    New Delhi, Oct 18 (UNI) The Delhi High Court on Tuesday dismissed a bail application of JNU student leader Umar Khalid arrested in the 2020 Delhi riots case.

Justices Siddharth Mridul and Rajnish Bhatnagar after hearing argument from both sides dismissed the bail saying the court did not find any merit in the plea.

Khalid's counsel moved the bail plea submitting that the student leader has been falsely implicated in the matter and did not have any role in the violence of Delhi's Northeast area.

Police opposed it saying that Khalid was arrested on September 13, 2020 on the charges of Unlawful Activities (Prevention) Act (UAPA).

Police has charged Khalid, Sharjeel Imam, and several others person under the anti-terror law and Indian Penal Code for allegedly being the masterminds of the protests and riots in Delhi's Jamia and Northeast area in the December 2019 and February 2020 violence during the protests against the Citizenship (Amendment) Act (CAA) and the National Register of Citizens (NRC) that left 53 people dead and over 700 injured.

UNI XC ING。客户端发完头部就超时、发body 也超时、整体发送还超时，三个时间窗口一收紧，攻击者就没了拖下去的空间。    http {    client_header_timeout 10s;   #读取请求头超时时间    client_body_timeout  10s;    #读取请求体超时时间    send_timeout         10s;    #发送响应超时时间    keepalive_timeout    30s;    #长连接保持时间         #限制单IP连接数，进一步压制慢连接    limit_conn_zone $binary_remote_addr zone=addr:10m;    server {    limit_conn addr 30;    }    }    这里的时间值不是越小越好。

二 | 如果你的接口有上传大文件的功能，client_body_timeout 可以放宽到 60 秒，甚至针对上传路径单独写一个 location。核心原则是：正常用户用不上那么长时间。    配置改完后用nginx -t 检查语法，reload 平滑生效。可以用 slowhttptest 工具自己压测一下，看改成 10 秒后连接还能不能被挂住。真实业务里我习惯把这几个值默认设为 10 秒，上传接口单独放开。

三 |

申请创业报道，分享创业好点子。点击此处，共同探讨创业新机遇！。

Current article:http://gphefme.focuolequzenkedenchaoruaxing.pics/news/20260826_99536.html

Published on:03:16:18