Introduction: Mod_evasive
Mod_evasive helps protect against attacks like DoS, DDoS (Distributed Denial of Service) and brute force attacks on Apache webserver. As the name suggests mod_evasive
provides evasive action in the event of attacks and reports malicious activities via email and Syslog.
Moreover, it also monitors the incoming traffic to the Apache web server using the internal dynamic hash table of IP addresses and URLs, then individual IP address blocks in they exceed a predetermined threshold.
In this tutorial, we will discuss the installation process, configure and how you can use mod_evasive
on your server.
System Requirements
- Newly deployed Ubuntu 16.04 server.
- Apache2 webserver setup and configured.
- A non-root user with sudo privileges. ## Update the System First, run an update on the server to ensure that all your packages are up to date. Use the following command:
sudo apt-get update -y
sudo apt-get upgrade -y
Once the server is up-to-date, you can now install mod_evasive.
Installing mod_evasive
We can simply install mod_evasive using the following command:
sudo apt-get install libapache2-mod-evasive -y
Verifying the Installation
The following command can be used to verify the installation of mod_evasive:
apachectl -M | grep evasive
If everything is ok, you should see the following output:
evasive20_module (shared)
We can also verify the mod_evasive configuration file to be sure if it is added. To verify run this command:
sudo ls -al /etc/apache2/mods-enabled/evasive.conf
The result should look similar to:
-rw-r--r-- 1 root root 3473 Jul 11 01:41 /etc/apache2/mods-enabled/evasive.conf
Configuring mod_evasive
Now that we have installed mod_evasive, letβs see how we customize mod_evasive through the evasive.conf configuration file. By default, mod_evasive configuration options are disabled. To enable it we need to edit evasive.conf file and then customize it to our preferred requirements.
Opening the configuration file with the nano text editor using the following command:
sudo nano /etc/apache2/mods-enabled/evasive.conf
Change the file as shown below:
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify email@yourdomain.com
DOSSystemCommand "su - someuser -c '/sbin/... %s ...'"
DOSLogDir "/var/log/mod_evasive"
</IfModule>
Save and close the file, then make a log directory for mod_evasive
.
mkdir /var/log/mod_evasive
chown -R www-data:www-data /var/log/mod_evasive
Now, restart Apache service:
systemctl restart apache2
The above settings are fully customizable and should be configured based on your serverβs capabilities and expected traffic flows.
Explanation of each parameter is as follows:
- DOSHashTableSize: Specifies how mod_evasive keeps track of whoβs accessing what. The larger the number the better the performance, but also consumes more memory.
- DOSPageCount: Specifies threshold for the number of requests for the same page per page interval.
- DOSSiteCount: Specifies threshold for the total number of requests for any object by the same user on the same listener by an IP address per site interval.
- DOSPageInterval: The interval used in the page count threshold.
- DOSSiteInterval: The interval used in the site count threshold.
- DOSBlockingPeriod: Specifies how long an IP address should be blocked (in seconds).
- DOSEmailNotify: Specifies the email address to notify whenever an IP address is blacklisted.
- DOSLogDir: Specifies the log directory. ## Test mod_evasive Once everything is configured properly, lets test to see whether the module is working correctly.
Here, we will use test.pl script that was written by mod_evasive developers to test mod_evasive.
This is a Perl script located at /usr/share/doc/libapache2-mod-evasive/examples/test.pl.
Run the script with the following command:
perl /usr/share/doc/libapache2-mod-evasive/examples/test.pl
If everything is fine, you should see the following output:
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
...
You can also check the mail log by running the following command:
tail -f /var/mail/www-data
You should see that 127.0.0.1 is blacklist by mod_evasive:
Message-Id: <E1cwkeH-0000WE-EQ@master>
From: www-data <www-data@node1>
To: you@yourdomain.com
Subject: HTTP BLACKLIST 127.0.0.1
mod_evasive HTTP Blacklisted 127.0.0.1
--1491635945-eximdsn-1804289383--
Other relevant posts
How To Set Up mod_rewrite for Apache on Ubuntu
Conclusion
However, you can read more about mod_security on their GitHub repository.
Top comments (0)