fail2ban against slowloris DDOS, is it possible?

[Sinchan]

hi all,

Yesterday, i'd try a little test to attack my ISPConfig server with slowloris ddos.
I have enable apache banning rules before doing little test.
This is my jail.conf :

[apache]

enabled = true
port    = http,https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-multiport]

enabled   = true
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]

enabled = true
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-overflows]

enabled = true
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2

When i starting attack my server with slowloris, web server is down, and fail2ban is didnt do anything

here apache error.log (a hundred lines actually) :

[...]
[Fri Jun 25 22:07:38 2010] [error] [client 111.222.333.444] request failed: error reading the headers
[Fri Jun 25 22:07:38 2010] [error] [client 111.222.333.444] request failed: error reading the headers
[Fri Jun 25 22:07:39 2010] [error] [client 111.222.333.444] request failed: error reading the headers
[Fri Jun 25 22:07:41 2010] [error] [client 111.222.333.444] request failed: error reading the headers
[...]

My question is : is it possible to prevent ddos attack such as slowloris with fail2ban?
Or maybe any other suggestion to prevent this attack?
any help is really appreciated

[till]

I think it should be possible as fail2ban detects anomalies in log files with regular expressions. I'am not a fail2ban expert, so I'am notable to tell you in detail on how to write that rule, but I think it should be possible. Maybe you find the solution already by looking at the other apache filter definitions.

[Sinchan]

okay Till, thanks for your fast reply.
I'll try to find another regex apache rules first, and if i found something useful, i will write here.

but, if there are any other suggestions or someone have already found a way, would be greatly appreciated