How to install and configure mod_evasive on SME8
What is mod_evasive? mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_evasive presently reports abuses via email and syslog facilities.
first add the epel reposiotry.
yum install mod_evasive --enablerepo=epel -y
prepare a tempalte custom
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/ cp /etc/httpd/conf.d/mod_evasive.conf /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive
then edit the file in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/ with your favorite editor mcedit, nano, pico, vi, vim ...
Then change according to your need the followings
- DOSHashTableSize 3097 : The hash table size defines the number of top-level nodes for each child's hash table.
- DOSPageCount 2 : This is the threshhold for the number of requests for the same page (or URI) per page interval
- DOSSiteCount 150 : This is the threshhold for the total number of requests for any object by the same client on the same listener per site interval. Once thethreshhold for that interval has been exceeded, the IP address of theclient will be added to the blocking list.
- DOSPageInterval 1 : The interval for the page count threshhold; defaults to 1 second intervals.
- DOSSiteInterval 1 : The interval for the site count threshhold; defaults to 1 second intervals.
- DOSBlockingPeriod 10 : The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list
- DOSEmailNotify : If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted.
- DOSSystemCommand : the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools. prevents continuous system calls. Use %s to denote the IP address of the blacklisted IP.
- DOSLogDir : Choose an alternative temp directory By default "/tmp" will be used for locking mechanism, which opens some security issues if your system is open to shell users.
- DOSWhitelist : You can use whitelists to disable the module for certain ranges of IPs.
I suggest to set at least DOSEmailNotify and DOSLogDir "/var/log/mod_evasive"
then create the directory
mkdir /var/log/mod_evasive chown www:www /var/log/mod_evasive
You could then easily set a jail with fail2ban that is checking theses logs...
expand template and restart apache expand-template /etc/httpd/conf/httpd.conf /etc/init.d/httpd-e-smith restart
check that the module was loaded:
apachectl -t -D DUMP_MODULES