mod_evasive

mod_evasive overview

mod_evasive module is aimed at protection from HTTP DoS or DDoS attacks and brute force attacks.

Sample configuration

Example:

<IfModule evasive_module>
    #optional directive (default value equals to 1024)
    DOSHashTableSize    1024
    
    #obligatory directives (if even one of them is not set, malfunctioning is possible)
    DOSPageCount        10
    DOSSiteCount        150
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
</IfModule>

mod_evasive directives

DOSHashTableSize

DOSHashTableSize directive defines the hash table size, i.e. the number of top-level nodes for each child's hash table. Increasing this number will provide faster performance by decreasing the number of iterations required to get to the record, but will consume more memory for table space. It is advisable to increase this parameter on heavy load web servers.

Example:

DOSHashTableSize 2048

DOSPageCount

DOSPageCount directive sets the threshold for the number of requests for the same page (or URI) per page interval. Once the threshold for that interval has been exceeded, the client IP address is added to the blocking list.

Example:

DOSPageCount 10

DOSSiteCount

DOSSiteCount directive sets the threshold for the total number of requests for any object by the same client on the same listener per site interval. Once the threshold for that interval has been exceeded, the client IP address is added to the blocking list.

Example:

DOSSiteCount 150

DOSPageInterval

DOSPageInterval directive sets the interval for the page count threshold.

The interval is specified in seconds and may be a real number.

Example:

DOSPageInterval 1.5

DOSSiteInterval

DOSSiteInterval directive sets the interval for the site count threshold.

The interval is specified in seconds and may be a real number.

Example:

DOSSiteInterval 1.5

DOSBlockingPeriod

DOSBlockingPeriod directive sets the amount of time that a client will be blocked for if they are added to the blocking list. During this time, all subsequent requests from the client will result in 403 (Forbidden) response and the timer will be reset (e.g. for another 10 seconds). Since the timer is reset for every subsequent request, it is not necessary to have a long blocking period; in the event of a DoS attack, this timer will keep getting reset.

The interval is specified in seconds and may be a real number.

Example:

DOSBlockingPeriod 10.7

DOSSystemCommand

DOSSystemCommand directive specifies the system command to be executed whenever an IP address becomes blacklisted.

DOSCloseSocket

DOSCloseSocket directive instructs mod_evasive to send 403 code and close connection socket. It means an attacker will have to create new connection and it's pretty good for you as it takes some time.