Best Practice for captcha based protection against D.O.S to Nginx Proxy

Posted by user325320 on Server Fault See other posts from Server Fault or by user325320
Published on 2012-06-26T08:47:26Z Indexed on 2012/06/26 9:17 UTC
Read the original article Hit count: 3267

Filed under:

nginx

|

ddos

|

dos

The idea is explained here

In simple words, Nginx Proxy plays the role of load balance and transmits the HTTP/HTTPS requests to servers.

If the number of request times within a certain period from an individual IP exceeds a threshold, it will trigger a captcha for the upcoming requests.

And the end-user must input the correct captcha code before he can continue to access the site.

Do you know any open source / free NGINX module for this usage? I searched on the Internet and here is one of them: https://github.com/snbuback/nginx seems it needs modification.

Any suggestion / experience is welcome, thank you

© Server Fault or respective owner

Related posts about nginx

ModSecurity compile error on nginx

as seen on Server Fault - Search for 'Server Fault'
I'm trying to install ModSecurity on nginx with the following instructions : wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip unzip master cd ModSecurity-master ./autogen.sh ./configure --enable-standalone-module And i got the following error : Checking plataform... Identified… >>> More
Cannot Start Nginx Compiled from Source

as seen on Server Fault - Search for 'Server Fault'
I am trying to compile Nginx from source based on the original compiled Nginx server running on my DigitalOcean server ( Ubuntu-14.04 64x ) but with a few extra modules. I can get everything installed smoothly but I can not get it to start. I am sure the ini is correct because I copied the original… >>> More
Nginx http_mp4_module seam installed but dont work

as seen on Server Fault - Search for 'Server Fault'
I try to use the http_mp4_module on my Ubuntu server but that didnt seem to work at all. When i check nginx -V i get : nginx version: nginx/1.1.19 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-client-body-temp-path=/var/lib/nginx/body… >>> More
GeoIP and Nginx

as seen on Server Fault - Search for 'Server Fault'
I have a nginx with geoip, but it is not working rightly. The issue is the next: Nginx are getting geodata from $_SERVER['REMOTE_ADDR'] instead of $_SERVER['HTTP_X_HAPROXY_IP'], which have the real client ip. So, the reported geodata belongs to my server ip instead of client ip. Does anybody where… >>> More
Nginx1.6.1: Installing from source not running corectly

as seen on Server Fault - Search for 'Server Fault'
I just installed Nginx 1.6.1 from source but it didn't seem to installed correctly. Nginx is running if I service nginx status but when I do nginx -v it outputs command not found. Regular HTML page shows fine and there is no error in the error logs. I am on AWS Ec2 linux AMI. Here is my /etc/init… >>> More

Related posts about ddos

How long do DDoS attacks last?

as seen on Server Fault - Search for 'Server Fault'
I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last? Just trying to get an idea of how long we'll have to continue to wage this battle (going on a couple weeks now). >>> More
DDoS and Heroku

as seen on Server Fault - Search for 'Server Fault'
I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do? >>> More
Brainstorm: Flood/DoS/DDoS Attack prevention ideas.

as seen on Server Fault - Search for 'Server Fault'
This is not a question asking how to stop an attack. This is simply a thread for anyone and everyone to discuss ideas for preventing, dealing with, and keeping your server alive during these attacks. Do not discuss using 3rd party software, this is a place to make your own ideas and read others. Post… >>> More
DDoS and Heroku

as seen on Stack Overflow - Search for 'Stack Overflow'
I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do? >>> More
Anti-DDoS Question

as seen on Server Fault - Search for 'Server Fault'
Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have no anti-DDoS mechanism, means that there is no point we get the Arbor Pravail? An DDoS attack can… >>> More