Disable / detect mod_reqtimeout to avoid upload problems

[ghost]

According to:

http://sabre.io/dav/webservers/

the Apache module could stop large uploads from completing. On Ubunutu 14.04 its not enabled by default anymore but it could be still useful to add a check similar to #6675 and #6637.

The .htaccess approach is probably recommended as the apache_get_modules approach is not working on PHP CGI.

[ghost]

Ok, an .htaccess entry like:

<IfModule reqtimeout_module>
  RequestReadTimeout header=0
  RequestReadTimeout body=0
</IfModule>

could do the trick.

[LukasReschke]

Care to submit a pull request? 😄

[ghost]

I'm not sure if disabling it completely is the best approach here? Any opinions?

[LukasReschke]

Disabling in our default .htaccess does not hurt :)

[ghost]

Context: server config, virtual host

from https://httpd.apache.org/docs/current/mod/mod_reqtimeout.html#requestreadtimeout so we can't use this in a .htaccess file.

[ghost]

Ref for the doc part: owncloud-archive/documentation#992

[ghost]

Just to have this documented here. Debian stable / jessie is now enabling this module by default again starting with the version 2.4.10-10+deb8u8 of Apache:

Activate mod_reqtimeout in new installs and during updates from before 2.4.10-10+deb8u8. It was wrongly not activated in new installs since jessie. This made the default installation vulnerable to some DoS attacks.

Trouble incoming...

[ghost]

Default setting on Debian (/etc/apache2/mods-enabled/reqtimeout.conf) below. Could those cause troubles for ownCloud?

 	# Wait max 20 seconds for the first byte of the request line+headers
	# From then, require a minimum data rate of 500 bytes/s, but don't
	# wait longer than 40 seconds in total.
	# Note: Lower timeouts may make sense on non-ssl virtual hosts but can
	# cause problem with ssl enabled virtual hosts: This timeout includes
	# the time a browser may need to fetch the CRL for the certificate. If
	# the CRL server is not reachable, it may take more than 10 seconds
	# until the browser gives up.
	RequestReadTimeout header=20-40,minrate=500

	# Wait max 10 seconds for the first byte of the request body (if any)
	# From then, require a minimum data rate of 500 bytes/s
	RequestReadTimeout body=10,minrate=500

[butonic]

at least documented in https://github.com/owncloud/documentation/blob/master/admin_manual/configuration/files/big_file_upload_configuration.rst#configuring-your-web-server

@tomneedham @PVince81 add check on the admin page?

[stale]

This issue has been automatically closed.