On 2026-08-24 02:06, Naveen Ali via Koha-devel wrote:
Greetings all,
I wanted to share a solution I recently identified to resolve the low latency attacks on OPAC.
In the last year or so, "libraries" have shown a soft underbelly to the proliferation of data-centred AI technology. On 1 Sept. last year our main Koha server (highly re-coded and customized 3.8.24, catalogue only no lending, nginx>apache2) got hit by 750,000 requests in six hours (normal daily ~125,000), reached thermal limits but was damaged before shutdown. This is maybe not strictly Koha (but you do mention a apache-shared-opac-antibot.conf but I got lost in git-test.koha-community.org/ looking for ANTIBOT_DO so can't comment.) We put in a couple of hundred hours on UFW and nginx (map, .conf and snippets, leaving apache2 "as is". We did not use fail2ban (after seriously considering it. Basically, it catches MS/Azure IP scraping and bans it, blocking that IP for legitimate users on the same Azure proxy or node. It also makes a dog's body out of UFW/IPTables, and ends up with a significant CPU cycle overhead.) I'd be happy to share our work, but again this is not strictly Koha, so must ask the moderators of this list (some of the old-timers will remember me) whether it's appropriate here and whether potential security aspects should be made publicly available. Aye, Paul --- Grumpy old sys-admin
I had fail2ban rules, robots.txt in place, but had been getting more and more bots of late switching IPs before bans can take place. Perhaps they could be ddos, either way it was grinding koha to a halt. I had also installed nginx for rate and connection limiting with no success. I had to remove OPAC from public interaction to restricted IPs.
I recently identified this *apache-shared-opac-antibot.conf *in Koha 24.11 which is disabled by default. I enabled it for my OPAC virtual host and it worked like a charm. It has been 5 days now of successful working.
I believe this is an effort by Mr. David Cook
I wanted to share this information because I had not been able to find this as a formal solution to this problem. Maybe because it has not been applied by many people.
Thanks a lot and best regards. Naveen Ali, I T Manager Engr Abul Kalam Library, NED University of Engg & Technology, Karachi, Pakistan.
_______________________________________________ Koha-devel mailing list -- koha-devel@lists.koha-community.org To unsubscribe send an email to koha-devel-leave@lists.koha-community.org website : https://www.koha-community.org/ git : https://git.koha-community.org/ bugs : https://bugs.koha-community.org/