From its README file:
“Mod_evasive is an evasive maneuvers module for Apache to provide evasive
action in the event of an HTTP DoS or DDoS attack or brute force attack. It
is also designed to be a detection tool, and can be easily configured to talk
to ipchains, firewalls, routers, and etcetera.
Detection is performed by creating an internal dynamic hash table of IP
Addresses and URIs, and denying any single IP address from any of the following:
- Requesting the same page more than a few times per second.
- Making more than 50 concurrent requests on the same child per second.
- Making any requests while temporarily blacklisted (on a blocking list).”
Its installation is quite easy:
apt-get install libapache2-mod-evasive
To configure it, create a directory to place its log files:
chown www-data:www-data /var/log/apache2/mod_evasive
Afterwards, create its configuration file with a default content (change “]” and “[" for ">" and "<" respectively):
This values should be optimized depending on the use of your server. Here are the params' descriptions:
DOSSystemCommand "/sbin/iptables -I INPUT -p tcp --dport 80 -s %s -j DROP"
To finish the configuration process, restart Apache:
You can test whether it works using a script included in the deb package: