Re: [bitfolk] Wordpress xml-rpc attacks

Top Page

Reply to this message
Author: Paul Tansom
Date:  
To: users
Subject: Re: [bitfolk] Wordpress xml-rpc attacks
** Andy Smith <andy@???> [2014-07-24 03:44]:
> On Wed, Jul 23, 2014 at 11:29:36PM +0100, Paul Tansom wrote:
> > This time round stopping and restarting Apache has made no
> > difference as when I restart the load increases within a few
> > minutes. Clearly a higher spec VM would help, but it seems silly
> > throwing resources at it rather than sorting it properly.
>
> The very first thing you should do is make it so that large numbers
> of simultaneous HTTP requests cannot bring down your entire VM.
>
> That is most likely happening because too many Apache children are
> running at once, using all the RAM and sending the VM into swap.
>
> If so then the first step would be to work out how many Apache
> children can actually be safely run simultaneously, and make sure
> that MaxClients is set so this maximum value. When the limit is
> reached the connections will stack up and your website will cease to
> respond, but your VM won't cease to respond.
>
> That will give you some chance to try some other approaches and see
> what works best.
>
> Further steps that don't involve increasing the RAM available might
> include lighttpd and/or nginx. At some point you're going to need
> something capable of interpreting PHP but if you can make as many
> requests as possible avoid getting that far, serving things out of
> cache, sending static requests to lighttd/nginx etc., then you get
> further.
>
> At the very least you can partition the sluggishness to just the
> requests that need to hit PHP: you could have PHP being called as CGI
> via a fixed number of FastCGI backend servers, while every other
> request is served directly by lighttpd/nginx much faster, even under
> load.
>
> Of course, Apache is easy, everything works with Apache, all the
> docs are for Apache. But Apache is a memory hog. It is a trade-off
> to use more memory and have an easier life. :)

** end quote [Andy Smith]

Yes, I've sort of got used to Apache and trundled along with it for what must
be about 15 years now. I have been seriously thinking of trying nginx recently
though, so this may just be the thing that makes be explore it further. I'm
going to have to look through my Apache config more closely now things have
settled down, I have a suspicion that somewhere along the line my
customisations have been removed - either during a reinstall or an update - as
I did have the number of children cranked down (I don't get much traffic after
all). As ever it is your own systems that get neglected.

--
Paul Tansom | Aptanet Ltd. | http://www.aptanet.com/ | 023 9238 0001
=============================================================================
Registered in England | Company No: 4905028 | Registered Office: Ralls House,
Parklands Business Park, Forrest Road, Denmead, Waterlooville, Hants, PO7 6XP