Install mod_evasive for Apache to Prevent DDOS Attacks

mod_evasive, formerly known as mod_dosevasive is a Apache module that provides evasive maneuvers action in the event of an HTTP DoS or DDoS (Denial of Service) attack or brute force attack at the web server. When possible attacks are detected, mod_evasive will block the traffic from the source for a specific duration of time, while reports abuses via email and syslog facilities. Or administrators can configure mod_evasive to talk to iptables, ipchains, firewalls, routers, and etc. to build a comprehensive DDOS prevention system for the high traffic busy web server.

Although mod_evasive is not a foolproof and complete DOS prevention system, but installing mod_evasive module for Apache will likely to reduce and stop certain DDOS attacks, minimizing the risks of web hosts and web sites been completely brought down inaccessible by malicious denial of service attack attempts.

How to Install mod_evasive

1. Login to web server via SSH.
2. For Apache 2.0.x, execute the following command:

   up2date -i httpd-devel

3. Continue with the following commands one by one for all version of Apache HTTPD server. wget command will download the current stable version 1.10.1 source tarball.

   cd /usr/local/src
   wget http://www.zdziarski.com/blog/wp-content/uploads/2010/02/mod_evasive_1.10.1.tar.gz
   tar -zxvf mod_evasive_1.10.1.tar.gz
   cd mod_evasive

4. For Apache 2.0.x , execute the following command:

   /usr/sbin/apxs -cia mod_evasive20.c

   Else, for Apache 1.3.x,

   /usr/local/apache/bin/apxs -cia mod_evasive.c

   Above commands will compile mod_evasive to .so and subsequently add corrensponding AddModule and LoadModule lines into httpd.conf.

5. mod_evasive comes with default configuration value preset, however, if webmasters want to configure and set the value themselves, the following parameters have to be added into httpd.conf Apache configuration file below the AddModule section.

   For Apache 2.0.x, add the following text to httpd.conf below AddModule section:

   <IfModule mod_evasive20.c>
   DOSHashTableSize 3097
   DOSPageCount 5
   DOSSiteCount 100
   DOSPageInterval 1
   DOSSiteInterval 1
   DOSBlockingPeriod 600
   </IfModule>

   For apache 1.3.x, add the following text to httpd.conf below AddModule section:

   <IfModule mod_evasive.c>
   DOSHashTableSize 3097
   DOSPageCount 5
   DOSSiteCount 100
   DOSPageInterval 1
   DOSSiteInterval 1
   DOSBlockingPeriod 600
   </IfModule>

   Save and exit the httpd.conf Apache configuration file.

6. Restart the Apache server with the following command:

   /etc/init.d/httpd restart

Note: If apxs is not found, it can be installed via “yum install httpd-devel” command.

Installation is completed. Note that mod_evasive has known issues with FrontPage Server Extensions. Administrator can configure the variables such as enlarging the DOSHashTableSize especially for busy server. But note that whenever when a sournce of attack is blocked, the blocking duration is automatically extended whenever the source attempts to connect again, thus the DOSBlockingPeriod needs not to be too long. Beside, the blocking is based on each sessions of Apache child process, thus the blocking has the lifespan of that particular session only. If webmaster set the maximum clients per process to a very low value, the blocking may not be very effective. All definitions of mod_evasive directives can be found on README file comes with the source codes.

Other than above common configuration parameters, mod_evasive also supports the following three advanced directives:

    DOSEmailNotify	[email protected]
    DOSSystemCommand	"su - someuser -c '/sbin/... %s ...'"
    DOSLogDir		"/var/lock/mod_evasive"

The DOSEmailNotify is particular useful, where you can set mod_evasive to send a notification email whenever a possible DOS attack is detected and blocked. For example, “DOSEmailNotify root” will send the email to root user. But note that mailer configuration (by default is “/bin/mail -t %s”) in mod_evasive.c or mod_evasive20.c is correct. You can create a symbolic link if needed to or modify the source code file.