Mod evasive

Languages:

English

	Skill level: Advanced
	The instructions on this page may require deviations from standard procedures. A good understanding of linux and Koozali SME Server is recommended.

Is this article helpful to you?
Please consider donating or volunteering
Thank you!

How to install and configure mod_evasive on SME8

About

What is mod_evasive? mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool, and can be easily configured to talk to ipchains, firewalls, routers, and etcetera. mod_evasive presently reports abuses via email and syslog facilities.

Installation

first add the epel reposiotry.

then

yum install mod_evasive --enablerepo=epel -y

prepare a tempalte custom

mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/
cp /etc/httpd/conf.d/mod_evasive.conf /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive

then edit the file in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/ with your favorite editor mcedit, nano, pico, vi, vim ...

vim /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive

Then change according to your need the followings

1. DOSHashTableSize 3097 : The hash table size defines the number of top-level nodes for each child's hash table.
2. DOSPageCount 2 : This is the threshhold for the number of requests for the same page (or URI) per page interval
3. DOSSiteCount 150 : This is the threshhold for the total number of requests for any object by the same client on the same listener per site interval. Once thethreshhold for that interval has been exceeded, the IP address of theclient will be added to the blocking list.
4. DOSPageInterval 1 : The interval for the page count threshhold; defaults to 1 second intervals.
5. DOSSiteInterval 1 : The interval for the site count threshhold; defaults to 1 second intervals.
6. DOSBlockingPeriod 10 : The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list
7. DOSEmailNotify : If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted.
8. DOSSystemCommand : the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools. prevents continuous system calls. Use %s to denote the IP address of the blacklisted IP.
9. DOSLogDir : Choose an alternative temp directory By default "/tmp" will be used for locking mechanism, which opens some security issues if your system is open to shell users.
10. DOSWhitelist : You can use whitelists to disable the module for certain ranges of IPs.

I suggest to set at least DOSEmailNotify and DOSLogDir "/var/log/mod_evasive"

then create the directory

mkdir /var/log/mod_evasive
chown www:www /var/log/mod_evasive

You could then easily set a jail with fail2ban that is checking theses logs...

expand template and restart apache
expand-template /etc/httpd/conf/httpd.conf
/etc/init.d/httpd-e-smith restart

check that the module was loaded:

apachectl -t -D DUMP_MODULES

source http://www.aru2l.org/index.php/forum/les-howtos/5958-mod_evasive-sur-sme8

Resources

http://www.zdziarski.com/blog/?page_id=442