Mod evasive

How to install and configure mod_evasive on SME8

first add EPEL repo

then

yum install mod_evasive --enablerepo=epel -y

prepare a tempalte custom

mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/
cp /etc/httpd/conf.d/mod_evasive.conf /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive

then edit the file in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/ with your favorite editor mcedit, nano, pico, vi, vim ...

vim /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/20mod_evasive

Then change according to your need the followings

1. DOSHashTableSize 3097 : The hash table size defines the number of top-level nodes for each child's hash table.
2. DOSPageCount 2 : This is the threshhold for the number of requests for the same page (or URI) per page interval
3. DOSSiteCount 150 : This is the threshhold for the total number of requests for any object by the same client on the same listener per site interval. Once thethreshhold for that interval has been exceeded, the IP address of theclient will be added to the blocking list.
4. DOSPageInterval 1 : The interval for the page count threshhold; defaults to 1 second intervals.
5. DOSSiteInterval 1 : The interval for the site count threshhold; defaults to 1 second intervals.
6. DOSBlockingPeriod 10 : The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list
7. DOSEmailNotify : If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted.
8. DOSSystemCommand : the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools. prevents continuous system calls. Use %s to denote the IP address of the blacklisted IP.
9. DOSLogDir : Choose an alternative temp directory By default "/tmp" will be used for locking mechanism, which opens some security issues if your system is open to shell users.
10. DOSWhitelist : You can use whitelists to disable the module for certain ranges of IPs.

I suggest to set at least DOSEmailNotify and DOSLogDir "/var/log/mod_evasive"

then create the directory

mkdir /var/log/mod_evasiv
chown www:www /var/log/mod_evasiv

You could then easily set a jail with fail2ban that is checking theses logs...

expand template and restart apache
expand-template /etc/httpd/conf/httpd.conf
/etc/init.d/httpd-e-smith restart

check that the module was loaded:

apachectl -t -D DUMP_MODULES

source http://www.aru2l.org/index.php/forum/les-howtos/5958-mod_evasive-sur-sme8