Apache 1.3 and 2.0 Flood/DoS/DDoS Protection with mod_dosevasive (Avoiding Denial of Service Attacks)

Apache 1.3 and 2.0 Flood/DoS/DDoS Protection with mod_dosevasive (Avoiding Denial of Service Attacks)

With the widespread infection of many computers with viruses, and the ever increasing number of Botnets, DoS and DDoS attacks can be quite frequent and can very easily bring a website to halt for days. This article provides a module solution for apache to help mitigate small http DoS and DDoS attacks.

Download the latest version of mod_dosevasive from: http://www.nuclearelephant.com/projects/dosevasive

The lastest version is 1.10 (http://www.nuclearelephant.com/projects/dosevasive/mod_dosevasive_1.10.tar.gz)

Untar it:

tar zxvf mod_dosevasive_1.10.tar.gz

Change into the directory:

cd mod_dosevasive

Compile mod_dosevasive apache module (Apache 2):

/usr/local/apache/bin/apxs -i -a -c mod_dosevasive20.c

or the following for apache 1.3:

/usr/local/apache/bin/apxs -i -a -c mod_dosevasive.c

Replace /usr/local/apache with your path to apache.

Edit your httpd.conf (usually located in /usr/local/apache/conf/httpd.conf):
Add:

<IfModule mod_dosevasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify someuser@somedomain.com
DOSSystemCommand “su – someuser -c ‘/sbin/… %s …’”
</IfModule>

- DOSHashTableSize: is the size of the table of URL and IP combined
- DOSPageCount: is the number of same page requests from the same IP during an interval that will cause that IP to be added to the block list.
- DOSSiteCount: is the number of pages requested of a site by the same IP during an interval which will cause the IP to be added to the block list.
- DOSPageInterval: is the interval that the hash table for IPs and URLs is erased (in seconds)
- DOSSiteInterval: is the intervale that the hash table of IPs is erased (in seconds)
- DOSBlockingPeriod: is the time the IP is blacked (in seconds)
- DOSEmailNotify: can be used to notify by sending an email everytime an IP is blocked
- DOSSystemCommand: is the command used to execute a command when an IP is blocked. It can be used to add a block the user from a firewall or router.
- DOSWhiteList: can be used to whitelist IPs such as 127.0.0.1

Although mod_dosevasive can be quite effective in some cases, in others it can cause more problems by blocking non-offending IPs. It is suggested you take a look at hardware solution if you

Similar Articles : How to install ffmpeg on CentOS or Redhat Enteprirse Linux the easy way (Using RPMs/Yum) Installing Pico on FreeBSDTurck MMCache for PHPApache 2 Install and Upgrade Guidelingerd – Setup and InstallationHowto mod_rewrite with ApacheGetting started with SSH TutorialHow to install PRM (Process Resource Monitor)How to install ionCube loaderApache Log Files ExplainedServer Loads ExplainedGuide to .htaccess tutorial and tipsOptimize and Tweak High-Traffic ServersCommon SSH Commands – Linux Shell CommandsUpgrade Guide From Red Hat 7.3 to 9.0,Changing Web Hosts? Step-By-Step GuideCustomizing PHP Safe ModeApache 2 PHP 4 and 5 (mod_php) on Linux – Apache2 PHP4 PHP5 InstallationFantastico Error: enc_restrictions.inc.php is protected by SourceGuardian and requires file ixed.lin.4.X.X.pxp, 4.3.7.pxp, 4.3.8.pxp, 4.3.9.pxp errorHow to Copy Files Across a Network/Internet in UNIX/LINUX (Redhat, Debian, FreeBSD, etc) – scp tar rsyncFixing rndc error in WHM/cPanel: rnd: connection failed: connection refusedwget – how to use tuturialcPanel Awstats Fix – Stoped Logging on single domainHow to Install Zend Optimizer/Encoder on cPanel/WHMUpgrading CentOS 3.3 to 3.4 using yumRedhat 7.3, 8.0, and 9.0 upgrade to CentOS 3 using yum (Red hat)Tutorial/HOW-TO: Kernel 2.6 Compilation with Grsecurity (grsec) – 2.6.5, 2.6.7, 2.6.8, 2.8.1, 2.6.9, 2.6.10, 2.6.11.6 Repairing a mySQL Database/Table – How to restore/repair/recoverFlood Protection/DoS/DDoS Apache 1.3 and 2.0 – mod_dosevasive (Avoiding Denial of Service Attacks)