Prevent Apache against Dos/DDos attack with mod_evasive

Sending a large number of HTTP requests to a web server is a type of DoS (Denial of Service) attack that increasingly overloads the server until it can no longer serve requests. This attack can be prevented easily by installing mod_evasive in Apache and making a few configuration changes. mod_evasive protects against attacks in three cases:

1. One IP makes the configured number of requests to the same page within the configured period.
2. One client makes more than the configured number of requests within the configured period.
3. A client continues making many requests while temporarily blacklisted.

Installing mod_evasive on CentOS

# yum install mod_evasive

The mod_evasive configuration file is /etc/httpd/conf.d/mod_evasive.conf. Its default configuration is shown below:

<IfModule mod_evasive20.c>
    DOSHashTableSize    3097 
    DOSPageCount        2 
    DOSSiteCount        50 
    DOSPageInterval     1 
    DOSSiteInterval     1 
    DOSBlockingPeriod   10 
</IfModule> 

Adjust the settings to suit your workload using the parameters below. Further details on tuning protection with mod_evasive

DOSHashTableSize - The hash table size defines the number of top-level nodes for each child’s hash table. Increasing this number will provide faster performance by decreasing the number of iterations required to get to the record, but consume more memory for table space DOSPageCount - This is the threshold for the number of requests for the same page (or URI) per page interval. Once the threshold for that interval has been exceeded, the IP address of the client will be added to the blocking list. DOSSiteCount - This is the threshold for the total number of requests for any object by the same client on the same listener per site interval. DOSPageInterval - The interval for the page count threshold; defaults to 1 second intervals. DOSSiteInterval - The interval for the site count threshold; defaults to 1 second intervals. DOSBlockingPeriod - The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list. During this time, all subsequent requests from the client will result in a 403 (Forbidden) and the timer being reset (e.g. another 10 seconds). DOSEmailNotify - If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted. A locking mechanism using /tmp prevents continuous emails from being sent. DOSSystemCommand - If this value is set, the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools. DOSLogDir - Choose an alternative temp directory, default is /tmp. DOSWhitelist - You can use whitelists to disable the module for certain ranges of IPs. Wildcards can be used on up to the last 3 octets if necessary. Multiple DOSWhitelist commands may be used in the configuration.

To check mod_evasive, repeatedly press F5 or refresh rapidly. If it works correctly, you will see a “403 Forbidden” page.