Ricardo Sismeiro rasismeiro

NGINX Tuning For Best Performance

For this configuration you can use web server you like, i decided, because i work mostly with it to use nginx.

Generally, properly configured nginx can handle up to 400K to 500K requests per second (clustered), most what i saw is 50K to 80K (non-clustered) requests per second and 30% CPU load, course, this was 2 x Intel Xeon with HyperThreading enabled, but it can work without problem on slower machines.

You must understand that this config is used in testing environment and not in production so you will need to find a way to implement most of those features best possible for your servers.

Stable version NGINX (deb/rpm)

GoDaddy SSL Certificates PEM Creation for HaProxy (Ubuntu 14.04)

1 Acquire your SSL Certificate

Generate your CSR This generates a unique private key, skip this if you already have one.

sudo openssl genrsa -out  etc/ssl/yourdomain.com/yourdomain.com.key 1024

Next generate your CSR (Certificate Signing Request), required by GoDaddy:

	## /lib/systemd/system/nginx.service
	## see https://www.nginx.com/resources/wiki/start/topics/examples/systemd/

	[Unit]
	Description=The NGINX HTTP and reverse proxy server
	After=syslog.target network.target remote-fs.target nss-lookup.target

	[Service]
	Type=forking
	PIDFile=/run/nginx.pid

	[Unit]
	Description=supervisord - Supervisor process control system for UNIX
	Documentation=http://supervisord.org
	After=network.target

	[Service]
	Type=forking
	ExecStart=/bin/supervisord -c /etc/supervisord/supervisord.conf
	ExecReload=/bin/supervisorctl reload
	ExecStop=/bin/supervisorctl shutdown

	#!/usr/bin/env python
	# CS-Cart session brute force exploit for v4.2.0
	# see https://www.nikcub.com/posts/cs-cart-v4-2-0-session-hijacking-and-other-vulnerabilities/

	import sys
	import requests
	import argparse
	import re
	import string
	import random

	<?php

	$a = new A();
	$reflection = new \ReflectionClass($a);
	$property = $reflection->getProperty('privateProperty');
	$property->setAccessible(true);
	$property->setValue($a, 'new-value');

	echo $a->getPrivateProperty();
	//outputs:

	#! /usr/bin/env php
	<?php
	/* PHP Slowloris
	* Adapted from the script found here: http://seclists.org/fulldisclosure/2009/Jun/207
	* Contains get based attack (slow headers) and post based attack (long content length)
	*
	* Author: Seppe vanden Broucke
	*/

	function usage($argv){