3,254
edits
Changes
From SME Server
Jump to navigationJump to searchCreated page with "How to install and configure mod_evasive on SME8 first add EPEL repo then yum install mod_evasive --enablerepo=epel -y prepare a tempalte custom mkdir -p /etc/e-smith/t..."
How to install and configure mod_evasive on SME8
first add EPEL repo
then
yum install mod_evasive --enablerepo=epel -y
prepare a tempalte custom
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/
cp /etc/httpd/conf.d/mod_evasive.conf /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive
then edit the file in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/ with your favorite editor mcedit, nano, pico, vi, vim ...
vim etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive
Then change according to your need the followings
# DOSHashTableSize 3097 : The hash table size defines the number of top-level nodes for each child's hash table.
# DOSPageCount 2 : This is the threshhold for the number of requests for the same page (or URI) per page interval
# DOSSiteCount 150 : This is the threshhold for the total number of requests for any object by the same client on the same listener per site interval. Once thethreshhold for that interval has been exceeded, the IP address of theclient will be added to the blocking list.
# DOSPageInterval 1 : The interval for the page count threshhold; defaults to 1 second intervals.
# DOSSiteInterval 1 : The interval for the site count threshhold; defaults to 1 second intervals.
# DOSBlockingPeriod 10 : The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list
# DOSEmailNotify : If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted.
# DOSSystemCommand : the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools. prevents continuous system calls. Use %s to denote the IP address of the blacklisted IP.
# DOSLogDir : Choose an alternative temp directory By default "/tmp" will be used for locking mechanism, which opens some security issues if your system is open to shell users.
# DOSWhitelist : You can use whitelists to disable the module for certain ranges of IPs.
I suggest to set at least DOSEmailNotify and DOSLogDir "/var/log/mod_evasive"
then create the directory
mkdir /var/log/mod_evasiv
chown www:www /var/log/mod_evasiv
You could then easily set a jail with fail2ban that is checking theses logs...
expand template and restart apache
expand-template /etc/httpd/conf/httpd.conf
/etc/init.d/httpd-e-smith restart
check that the module was loaded:
apachectl -t -D DUMP_MODULES
source
http://www.aru2l.org/index.php/forum/les-howtos/5958-mod_evasive-sur-sme8
first add EPEL repo
then
yum install mod_evasive --enablerepo=epel -y
prepare a tempalte custom
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/
cp /etc/httpd/conf.d/mod_evasive.conf /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive
then edit the file in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/ with your favorite editor mcedit, nano, pico, vi, vim ...
vim etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive
Then change according to your need the followings
# DOSHashTableSize 3097 : The hash table size defines the number of top-level nodes for each child's hash table.
# DOSPageCount 2 : This is the threshhold for the number of requests for the same page (or URI) per page interval
# DOSSiteCount 150 : This is the threshhold for the total number of requests for any object by the same client on the same listener per site interval. Once thethreshhold for that interval has been exceeded, the IP address of theclient will be added to the blocking list.
# DOSPageInterval 1 : The interval for the page count threshhold; defaults to 1 second intervals.
# DOSSiteInterval 1 : The interval for the site count threshhold; defaults to 1 second intervals.
# DOSBlockingPeriod 10 : The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list
# DOSEmailNotify : If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted.
# DOSSystemCommand : the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools. prevents continuous system calls. Use %s to denote the IP address of the blacklisted IP.
# DOSLogDir : Choose an alternative temp directory By default "/tmp" will be used for locking mechanism, which opens some security issues if your system is open to shell users.
# DOSWhitelist : You can use whitelists to disable the module for certain ranges of IPs.
I suggest to set at least DOSEmailNotify and DOSLogDir "/var/log/mod_evasive"
then create the directory
mkdir /var/log/mod_evasiv
chown www:www /var/log/mod_evasiv
You could then easily set a jail with fail2ban that is checking theses logs...
expand template and restart apache
expand-template /etc/httpd/conf/httpd.conf
/etc/init.d/httpd-e-smith restart
check that the module was loaded:
apachectl -t -D DUMP_MODULES
source
http://www.aru2l.org/index.php/forum/les-howtos/5958-mod_evasive-sur-sme8
