The number of allowed simultaneous requests must be set.

From APACHE SITE 2.2 for Unix Security Technical Implementation Guide

Part of WG110

Associated with IA controls: ECSC-1

SV-33018r1_rule The number of allowed simultaneous requests must be set.

Vulnerability discussion

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive).

Check content

To view the MaxKeepAliveRequests value, enter the following command: grep "MaxKeepAliveRequests" /usr/local/apache2/conf/httpd.conf If the returned value of MaxKeepAliveRequests is not set to 100 or greater, this is a finding.

Fix text

Edit the httpd.conf file and set the MaxKeepAliveRequests directive to 100 or greater.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.