- up to 2.4.4; fixes CVE-2012-3499, CVE-2012-4558

[packages/apache.git] / apache-httpd.conf

diff --git a/apache-httpd.conf b/apache-httpd.conf
index 177a860967681c26cae1f647b02d607a08015de5..60453a0fb867b220074a78776c82b7371aaa2e3a 100644 (file)
--- a/apache-httpd.conf
+++ b/apache-httpd.conf
@@ -52,7 +52,7 @@ ErrorLog logs/error_log
 # alert, emerg.
 LogLevel warn
 
-Timeout 300
+Timeout 60
 KeepAlive On
 MaxKeepAliveRequests 100
 KeepAliveTimeout 5
@@ -71,6 +71,21 @@ IncludeOptional conf.d/*.conf
 # Include webapps config
 IncludeOptional webapps.d/*.conf
 
+#
+# Set a timeout for how long the client may take to send the request header
+# and body.
+# The default for the headers is header=20-40,MinRate=500, which means wait
+# for the first byte of headers for 20 seconds. If some data arrives,
+# increase the timeout corresponding to a data rate of 500 bytes/s, but not
+# above 40 seconds.
+# The default for the request body is body=20,MinRate=500, which is the same
+# but has no upper limit for the timeout.
+# To disable, set to header=0 body=0
+#
+<IfModule reqtimeout_module>
+  RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
+</IfModule>
+
 <IfModule alias_module>
        # ScriptAlias: This controls which directories contain server scripts.
        # ScriptAliases are essentially the same as Aliases, except that