Mod_evasive helps protect against attacks like DoS, DDoS (Distributed Denial of Service) and brute force attacks on Apache web server. As the name suggests mod_evasive provide evasive action in the event of attacks and reports malicious activities via email and syslog.
Moreover, it also monitors the incoming traffic to the Apache web server using the internal dynamic hash table of IP addresses and URLs, then individual IP address blocks in they exceed a predetermined threshold.
In this tutorial, we will discuss the installation process, configure and how you can use mod_evasive on your server.
- Newly deployed Ubuntu 16.04 server.
- Apache2 web server setup and configured.
- A non-root user with sudo privileges.
Update the System
First, run an update on the server to ensure that all your packages are up to date. Use the following command:
sudo apt-get update -y sudo apt-get upgrade -y
Once the server is up-to-date, you can now install mod_evasive.
We can simply install mod_evasive using the following command:
sudo apt-get install libapache2-mod-evasive -y
Verifying the Installation
The following command can be used to verify the installation of mod_evasive:
apachectl -M | grep evasive
If everything is ok, you should see the following output:
We can also verify the mod_evasive configuration file to be sure if it is added. To verify run this command:
sudo ls -al /etc/apache2/mods-enabled/evasive.conf
The result should look similar to:
-rw-r--r-- 1 root root 3473 Jul 11 01:41 /etc/apache2/mods-enabled/evasive.conf
Now that we have installed mod_evasive, let’s see how we customize mod_evasive through the evasive.conf configuration file. By default, mod_evasive configuration options are disabled. To enable it we need to edit evasive.conf file and then customize it to our preferred requirements.
Opening the configuration file with the nano text editor using the following command:
sudo nano /etc/apache2/mods-enabled/evasive.conf
Change the file as shown below:
<IfModule mod_evasive20.c> DOSHashTableSize 3097 DOSPageCount 2 DOSSiteCount 50 DOSPageInterval 1 DOSSiteInterval 1 DOSBlockingPeriod 10 DOSEmailNotify firstname.lastname@example.org DOSSystemCommand "su - someuser -c '/sbin/... %s ...'" DOSLogDir "/var/log/mod_evasive" </IfModule>
Save and close the file, then make a log directory for mod_evasive.
mkdir /var/log/mod_evasive chown -R www-data:www-data /var/log/mod_evasive
Now, restart Apache service:
systemctl restart apache2
The above settings are fully customizable and should be configured based on your server’s capabilities and expected traffic flows as follows:
Explanation of each parameter is as follows:
- DOSHashTableSize: Specifies how mod_evasive keeps track of who’s accessing what. The larger the number the better the performance, but also consumes more memory.
- DOSPageCount: Specifies threshold for the number of requests for the same page per page interval.
- DOSSiteCount: Specifies threshold for the total number of requests for any object by the same user on the same listener by an IP address per site interval.
- DOSPageInterval: The interval used in the page count threshold.
- DOSSiteInterval: The interval used in the site count threshold.
- DOSBlockingPeriod: Specifies how long an IP address should be blocked (in seconds).
- DOSEmailNotify: Specifies the email address to notify whenever an IP address is blacklisted.
- DOSLogDir: Specifies the log directory.
Once everything is configured properly, lets test to see whether the module is working correctly.
Here, we will use
This is a Perl script located
Run the script with the following command:
If everything is fine, you should see the following output:
HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden ...
You can also check the mail log by running the following command:
tail -f /var/mail/www-data
You should see that
127.0.0.1 is blacklist by mod_evasive:
Message-Id: <E1cwkeH-0000WE-EQ@master> From: www-data <www-data@node1> To: email@example.com Subject: HTTP BLACKLIST 127.0.0.1 mod_evasive HTTP Blacklisted 127.0.0.1 --1491635945-eximdsn-1804289383--
Other relevant tutorials
However, you can read more about mod_security on their GitHub repository.