Apache2 : Configure mod_evasive2024/05/31 |
Enable mod_evasive module to defend from DoS attacks and so on. |
|
[1] | Install and configure mod_evasive. |
root@www:~#
apt -y install libapache2-mod-evasive
root@www:~#
vi /etc/apache2/mods-available/evasive.conf # uncomment each line to configure <IfModule mod_evasive20.c> # hash table size DOSHashTableSize 3097 # threshold for the number of requests for the same page per page interval DOSPageCount 2 # threshold for the total number of requests for any object by the same client on the same listener per site interval DOSSiteCount 50 # the interval for the page count threshold DOSPageInterval 1 # the interval for the site count threshold DOSSiteInterval 1 # amount of time (in seconds) that a client will be blocked for if they are added to the blocking list DOSBlockingPeriod 10 # uncomment and configure follows if you need # notification address if IP address becomes blacklisted #DOSEmailNotify root@localhost # possible to set any command #DOSSystemCommand "su - someuser -c '/sbin/... %s ...'" # log directory #DOSLogDir "/var/log/mod_evasive" </IfModule>root@www:~# mkdir /var/log/mod_evasive root@www:~# chown www-data:www-data /var/log/mod_evasive root@www:~# systemctl reload apache2 |
[2] | Test to access to Apache2. |
root@www:~# for ((i=1; i <= 20; i++)); do curl -I localhost; done
HTTP/1.1 200 OK
Date: Fri, 31 May 2024 01:31:07 GMT
Server: Apache/2.4.58 (Ubuntu)
Upgrade: h2,h2c
Connection: Upgrade
Last-Modified: Thu, 30 May 2024 23:46:27 GMT
ETag: "29af-619b479c01d06"
Accept-Ranges: bytes
Content-Length: 10671
Vary: Accept-Encoding
Content-Type: text/html
HTTP/1.1 200 OK
Date: Fri, 31 May 2024 01:31:07 GMT
Server: Apache/2.4.58 (Ubuntu)
Upgrade: h2,h2c
Connection: Upgrade
Last-Modified: Thu, 30 May 2024 23:46:27 GMT
ETag: "29af-619b479c01d06"
Accept-Ranges: bytes
Content-Length: 10671
Vary: Accept-Encoding
Content-Type: text/html
.....
.....
# turn to "403 Forbidden" if blocked
HTTP/1.1 403 Forbidden
Date: Fri, 31 May 2024 01:31:07 GMT
Server: Apache/2.4.58 (Ubuntu)
Content-Type: text/html; charset=iso-8859-1
HTTP/1.1 403 Forbidden
Date: Fri, 31 May 2024 01:31:07 GMT
Server: Apache/2.4.58 (Ubuntu)
Content-Type: text/html; charset=iso-8859-1
.....
.....
# if blocked, logs are recorded root@www:~# ll /var/log/mod_evasive total 16 drwxr-xr-x 2 www-data www-data 4096 May 31 01:35 ./ drwxrwxr-x 13 root syslog 4096 May 31 01:34 ../ -rw-r--r-- 1 www-data www-data 5 May 31 01:35 dos-10.0.0.52 -rw-r--r-- 1 www-data www-data 5 May 31 01:35 dos-::1 # if set notification, it is sent like follows root@www:~# mail "/var/mail/root": 3 messages 3 new >N 1 root@www.srv.worl Fri May 31 01:30 30/1204 Cron <www-data@www> [ -x /u N 2 www-data@www.srv. Fri May 31 01:35 19/601 N 3 www-data@www.srv. Fri May 31 01:35 19/613 & 3 Message 3: From www-data@www.srv.world Fri May 31 01:35:54 2024 X-Original-To: root@localhost To: root@localhost MIME-Version: 1.0 Content-Type: text/plain; charset="ANSI_X3.4-1968" Content-Transfer-Encoding: 8bit Date: Fri, 31 May 2024 01:35:54 +0000 (UTC) From: www-data <www-data@www.srv.world> To: root@localhost Subject: HTTP BLACKLIST 10.0.0.52 mod_evasive HTTP Blacklisted 10.0.0.52 |
Sponsored Link |
|