{"id":936,"date":"2012-12-12T03:21:34","date_gmt":"2012-12-12T09:21:34","guid":{"rendered":"http:\/\/blog.supportpro.com\/?p=936"},"modified":"2018-10-04T02:02:02","modified_gmt":"2018-10-04T08:02:02","slug":"mod_evasive","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/mod_evasive\/","title":{"rendered":"mod_evasive"},"content":{"rendered":"

mod_evasive is a detection and network management tool, and can be easily configured to talk to IP chains, firewalls,
\nrouters, etc . Detection is performed by creating an internal dynamic hash table of IP Addresses and URLs, and denying
\nany single IP address that matches the criteria.<\/p>\n

#cd \/usr\/src
\n#wget http:\/\/www.zdziarski.com\/blog\/wp-content\/uploads\/2010\/02\/mod_evasive_1.10.1.tar.gz
\n#tar xzf mod_evasive_1.10.1.tar.gz
\n#cd mod_evasive
\n#apxs -cia mod_evasive20.c<\/p><\/blockquote>\n

LoadModule evasive20_module \/usr\/lib\/httpd\/modules\/mod_evasive20.so<\/p>\n

Add configuration rules to the Apache conf file: \/etc\/httpd\/conf\/httpd.conf<\/p>\n

<IfModule mod_evasive20.c>
\nDOSHashTableSize 3097
\nDOSPageCount 2
\nDOSSiteCount 50
\nDOSPageInterval 1
\nDOSSiteInterval 1
\nDOSBlockingPeriod 60
\nDOSEmailNotify someone@somewhere.com
\n<\/IfModule><\/p><\/blockquote>\n

Restart Apache :<\/p>\n

\/etc\/init.d\/httpd restart<\/p><\/blockquote>\n

DOSHashTableSize<\/strong> : It is the size of the hash table that is created for the IP addresses monitored.
\nDOSPageCount <\/strong>: It is the number of pages allowed to be loaded for the DOSPageInterval setting. In this case, 2 pages per 1 second before the IP gets flagged.
\nDOSSiteCount <\/strong>: It is the number of objects (ie: images, style sheets, javascripts, SSI, etc) allowed to be accessed in theDOSSiteInterval second. In this case, 50 objects per 1 second.
\nDOSPageInterval <\/strong>: It is the number of seconds the intervals are set for DOSPageCount
\nDOSSiteInterval <\/strong>: It is the number of seconds the intervals are set for DOSSiteCount
\nDOSBlockingPeriod <\/strong>: It is the number of seconds the IP address will recieve the Error 403 (Forbidden) page when they have been flagged.<\/p>\n

DOSBlockingPeriod <\/strong>: If an IP is determined to be malicious, it is banned for this period of time. Each infraction that occurs will blacklisted adds an additional interval of this amount.<\/p>\n

Whitelisting IP Addresses<\/strong><\/p>\n

For whitelisting an address (or range) which is sure not to be an attacker, add an entry to the Apache configuration like this.<\/p>\n

DOSWhitelist 127.0.0.1 DOSWhitelist 127.0.0.*<\/p><\/blockquote>\n

\/etc\/init.d\/httpd restart<\/div>\n

If you require help, contact SupportPRO Server Admin<\/a><\/p>\n

\"Server<\/a><\/span>