The number of allowed simultaneous requests will be limited for web sites.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2240	WG110	SV-2240r1_rule		Medium

Description
Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive).

Description

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive, (i.e., a parameter used to limit the amount of time a connection may be inactive).

STIG	Date
IIS 7.0 Server STIG	2019-03-22

Details

Check Text ( C-29061r1_chk )
To view the MaxKeepAliveRequests value enter the following command: grep "MaxKeepAliveRequests" /usr/local/apache2/conf/httpd.conf If the value of MaxKeepAliveRequests is not set to 100 or greater, then this is a finding. Note: The default value is 100

Fix Text (F-26067r1_fix)
Edit the httpd.conf file and set the MaxKeepAliveRequests directive to 100 or greater.