# New denial of service tool knocks out encrypting servers **URL:** \ **Category:** NGINX\ **Created:** [October 26, 2011, 4:59am UTC](https://www.ruby-forum.com/t/new-denial-of-service-tool-knocks-out-encrypting-servers/213195 "2011-10-26T04:59:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\ **Post date:** [October 26, 2011, 4:59am UTC](https://www.ruby-forum.com/t/new-denial-of-service-tool-knocks-out-encrypting-servers/213195/1 "2011-10-26T04:59:24Z")
> **[New denial of service tool knocks out encrypting servers - The H Security:...](http://www.h-online.com/security/news/item/New-denial-of-service-tool-knocks-out-encrypting-servers-1366564.html)** > > German hacking group THC has released a tool enabling a single computer to knock out a web or email server offering optional or compulsory SSL encryption I link the article to make sure everyone see’s it; but also to frame a question. The “Fix” seems to be to simply disable SSL-Renegotiation so that its not hammered over and over. The question: How do you disable SSL Renegotiation on Nginx? I tried googling “Nginx Disable SSL Renegotiation” but all that came back was patches to add the ability TO disable it in Nginx, no actual config option. Anyone know? ---
**Author:** ![ericgoodwin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/c68b51/32.png) [@ericgoodwin](https://www.ruby-forum.com/u/ericgoodwin)\ **Post date:** [October 26, 2011, 7:10am UTC](https://www.ruby-forum.com/t/new-denial-of-service-tool-knocks-out-encrypting-servers/213195/2 "2011-10-26T07:10:08Z")
2011/10/26 Eric G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > [http://www.h-online.com/security/news/item/New-denial-of-service-tool-knocks-out-encrypting-servers-1366564.html](http://www.h-online.com/security/news/item/New-denial-of-service-tool-knocks-out-encrypting-servers-1366564.html) > I link the article to make sure everyone see’s it; but also to frame a > question. The “Fix” seems to be to simply disable SSL-Renegotiation so > that its not hammered over and over. The question: How do you disable > SSL Renegotiation on Nginx? I tried googling “Nginx Disable SSL > Renegotiation” but all that came back was patches to add the ability > TO disable it in Nginx, no actual config option. Anyone know? The real thing is here: [http://www.thc.org/thc-ssl-dos/](http://www.thc.org/thc-ssl-dos/) Just by looking over it, it seems there is no generic solution to the problem, but a specific defense to this attack could be to limit the throughput of SSL handshakes, and to queue pending requests, prioritizing the host with the least number of handshake requests in this queue. Also, more than a sane number of handshake requests from a single host could be dropped. – Lucas Clemente Vella [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![ericgoodwin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/c68b51/32.png) [@ericgoodwin](https://www.ruby-forum.com/u/ericgoodwin)\ **Post date:** [October 26, 2011, 7:35am UTC](https://www.ruby-forum.com/t/new-denial-of-service-tool-knocks-out-encrypting-servers/213195/3 "2011-10-26T07:35:22Z")
Hello! On Tue, Oct 25, 2011 at 10:58:33PM -0400, Eric G. wrote: > [http://www.h-online.com/security/news/item/New-denial-of-service-tool-knocks-out-encrypting-servers-1366564.html](http://www.h-online.com/security/news/item/New-denial-of-service-tool-knocks-out-encrypting-servers-1366564.html) > I link the article to make sure everyone see’s it; but also to frame a > question. The “Fix” seems to be to simply disable SSL-Renegotiation so > that its not hammered over and over. The question: How do you disable > SSL Renegotiation on Nginx? I tried googling “Nginx Disable SSL > Renegotiation” but all that came back was patches to add the ability > TO disable it in Nginx, no actual config option. Anyone know? Renegotiation is unconditionally disabled since nginx 0.8.23 / 0.7.64, see CHANGES: Changes with nginx 0.8.23 11 Nov 2009 ``` *) Security: now SSL/TLS renegotiation is disabled. ``` Changes with nginx 0.7.64 16 Nov 2009 ``` *) Security: now SSL/TLS renegotiation is disabled. ``` Maxim D. ---
**Author:** ![ericgoodwin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/c68b51/32.png) [@ericgoodwin](https://www.ruby-forum.com/u/ericgoodwin)\ **Post date:** [October 26, 2011, 7:38am UTC](https://www.ruby-forum.com/t/new-denial-of-service-tool-knocks-out-encrypting-servers/213195/4 "2011-10-26T07:38:27Z")
* * * nginx mailing list removed\_email\_address@domain.invalid [http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx)