documentation_complete: true

prodtype: rhel7

title: 'Configure The Number of Allowed Simultaneous Requests'

description: |-
    The <tt>MaxKeepAliveRequests</tt> directive should be set and configured to
    <sub idref="var_max_keepalive_requests" /> or greater by setting the following
    in <tt>/etc/httpd/conf/httpd.conf</tt>:
    <pre>MaxKeepAliveRequests <sub idref="var_max_keepalive_requests" /></pre>

rationale: |-
    Resource exhaustion can occur when an unlimited number of concurrent requests
    are allowed on a web site, facilitating a denial of service attack. Mitigating
    this kind of attack will include limiting the number of concurrent HTTP/HTTPS
    requests per IP address and may include, where feasible, limiting parameter
    values associated with keepalive, (i.e., a parameter used to limit the amount of
    time a connection may be inactive).

severity: medium

identifiers:
    cce: "80551-5"

references:
    disa: ""
    nist: ""
    srg: ""
    stigid: WG110

ocil_clause: 'it is not'

ocil: |-
    To verify if <tt>MaxKeepAliveRequests</tt> is configured correctly in
    <tt>/etc/httpd/conf/httpd.conf</tt>, run the following command:
    <pre>$ grep -i maxkeepaliverequests /etc/httpd/conf/httpd.conf</pre>
    The command should return the following:
    <pre>MaxKeepAliveRequests 100</pre>
