reduce the chance making PHP worker process out-of-memory

[ccto]

Hello DA support, and other users -

To reduce the chance making PHP worker process out-of-memory, inside ModSecurity, do you think

• set SecRequestBodyLimitAction = reject (instead of ProcessPartial)
• set SecRequestBodyLimit (from 12.5M to (e.g.) 25M)
• set SecUploadFileLimit = 10 (default is 100, i.e. multiple file upload limit)

i.e.

• When the HTTP request size (with file) is over 25MB, it will be rejected. (instead of partial processing and accept it)
• 25MB shall be sufficient for webmail, and does not make PHP worker died

 

[ccto]

Hello DA support, and other users -

To reduce the chance making PHP worker process out-of-memory, inside ModSecurity, do you think

• set SecRequestBodyLimitAction = reject (instead of ProcessPartial)
• set SecRequestBodyLimit (from 12.5M to (e.g.) 25M)
• set SecUploadFileLimit = 10 (default is 100, i.e. multiple file upload limit)

i.e.

• When the HTTP request size (with file) is over 25MB, it will be rejected. (instead of partial processing and accept it)
• 25MB shall be sufficient for webmail, and does not make PHP worker died

 

[zEitEr]

Hello,

Looks fine from here. Did you happen to test the settings already?

 

[ccto]

Or, another just a thought -

From Google AI, when client sends HTTP request to server, there are no compression.
That is, we may use iptables/csf to limit incoming port 80,443 connbytes to (e.g.) 26MB (a little bit more than 25MB).

(However, drawback is - we cannot whitelist per domain/user)