Mod_evasive Configuration with Apache on Ubuntu Server 16.04

Introduction: Mod_evasive

Mod_evasive helps protect against attacks like DoS, DDoS (Distributed Denial of Service) and brute force attacks on Apache web server. As the name suggests mod_evasive provide evasive action in the event of attacks and reports malicious activities via email and syslog.

Moreover, it also monitors the incoming traffic to the Apache web server using the internal dynamic hash table of IP addresses and URLs, then individual IP address blocks in they exceed a predetermined threshold.

In this tutorial, we will discuss the installation process, configure and how you can use mod_evasive on your server.

System Requirements

  • Newly deployed Ubuntu 16.04 server.
  • Apache2 web server setup and configured.
  • A non-root user with sudo privileges.

Update the System

First, run an update on the server to ensure that all your packages are up to date. Use the following command:

Once the server is up-to-date, you can now install mod_evasive.

Installing mod_evasive

We can simply install mod_evasive using the following command:

Verifying the Installation

The following command can be used to verify the installation of mod_evasive:

If everything is ok, you should see the following output:

We can also verify the mod_evasive configuration file to be sure if it is added. To verify run this command:

The result should look similar to:

Configuring mod_evasive

Now that we have installed mod_evasive, let’s see how we customize mod_evasive through the evasive.conf configuration file. By default, mod_evasive configuration options are disabled. To enable it we need to edit evasive.conf file and then customize it to our preferred requirements.

Opening the configuration file with the nano text editor using the following command:

Change the file as shown below:

Save and close the file, then make a log directory for mod_evasive.

Now, restart Apache service:

The above settings are fully customizable and should be configured based on your server’s capabilities and expected traffic flows as follows:

Explanation of each parameter is as follows:

  • DOSHashTableSize: Specifies how mod_evasive keeps track of who’s accessing what. The larger the number the better the performance, but also consumes more memory.
  • DOSPageCount: Specifies threshold for the number of requests for the same page per page interval.
  • DOSSiteCount: Specifies threshold for the total number of requests for any object by the same user on the same listener by an IP address per site interval.
  • DOSPageInterval: The interval used in the page count threshold.
  • DOSSiteInterval: The interval used in the site count threshold.
  • DOSBlockingPeriod: Specifies how long an IP address should be blocked (in seconds).
  • DOSEmailNotify: Specifies the email address to notify whenever an IP address is blacklisted.
  • DOSLogDir: Specifies the log directory.

Test mod_evasive

Once everything is configured properly, lets test to see whether the module is working correctly.

Here, we will use script that was written by mod_evasive developers to test mod_evasive.
This is a Perl script located at /usr/share/doc/libapache2-mod-evasive/examples/

Run the script with the following command:

If everything is fine, you should see the following output:

You can also check the mail log by running the following command:

You should see that is blacklist by mod_evasive:

Other relevant tutorials

How To Set Up mod_rewrite for Apache on Ubuntu


However, you can read more about mod_security on their GitHub repository.

Clemence Ayekple

Let's grab a cup of coffee and talk about programming


This site uses Akismet to reduce spam. Learn how your comment data is processed.

  • Hmm it looks like your website ate my first comment (it was super long) so
    I guess I’ll just sum it up what I submitted and say, I’m thoroughly enjoying your blog.
    I as well am an aspiring blog writer but I’m still new to
    the whole thing. Do you have any points for beginner blog
    writers? I’d genuinely appreciate it.

Follow us

Don't be shy, get in touch. We love meeting interesting people and making new friends.

Most discussed

%d bloggers like this: