Published : 2011-09-30

mod evasive

Apache is a web server. In large organizations it is important to define a load distribution (load balancing) policy so the service can absorb the number of clients and limit large-scale attacks.

This article looks at the mod-evasive package (formerly known as mod-dosevasive), which reduces the load on your server and helps protect against Denial Of Service attacks.

Installation

To install mod-evasive, run:

# Debian
apt-get install libapache-mod-evasive
# Redhat
yum install mod-evasive

To configure the module, create the configuration file /etc/apache2/conf.d/evasive:

touch /etc/apache2/conf.d/evasive
# or
echo "" > /etc/apache2/conf.d/evasive

Then edit the file and add the following snippet to load the module:

<ifmodule mod_evasive20.c>
</ifmodule>

Configuration

To configure mod-evasive, add the directives inside the ifmodule tags of /etc/apache2/conf.d/evasive.

Let’s review the available options:

  • DOSSiteCount: number of requests allowed within a given interval. Be careful: if you use AJAX, you will need to raise this value according to the number of calls.
  • DOSSiteInterval: time interval (in seconds) for DOSSiteCount.
  • DOSPageCount: number of requests allowed on a single page within a given interval.
  • DOSPageInterval: time interval for DOSPageCount.
  • DOSBlockingPeriod: time during which blacklisted IPs cannot connect to the site and receive a 403 error.
  • DOSWhiteList: an IP or range that is always allowed; you should whitelist 127.0.0.1.
  • DOSSystemCommand: command to run when an IP is added to the mod-evasive blacklist.
  • DOSEmailNotify: email address that receives the mod-evasive alert when someone is blocked.

Configuration Examples

Here are a few configuration examples depending on the traffic you need to absorb.

Fewer than 100 concurrent connections:

DOSPageCount 100
DOSPageInterval 1
DOSSiteInterval 1
DOSSiteCount 120
DOSBlockingPeriod 30

For 100 to 500 concurrent connections, or if traffic arrives through a NAT gateway (so a single IP):

DOSPageCount 500
DOSPageInterval 1
DOSSiteCount 1000
DOSBlockingPeriod 20

For more than 1000 concurrent connections:

DOSPageCount 2000
DOSPageInterval 1
DOSSiteCount 5000
DOSBlockingPeriod 20

You now know how to manage traffic effectively on your Apache. Do not forget to raise the MaxKeepAliveRequests directive in /etc/apache2/apache2.conf so the server can handle the traffic.