Mod\_evasive is a module for Apache that provides evasive action in the event of an HTTP DoS, DDoS (distributed denial of service), or brute force attack. It simply provides evasive action necessary to keep servers up and running.
1. Install mod\_evasive:
If you’re using Ubuntu or any other Debian-based distribution:
```
sudo apt-get install libapache2-mod-evasive
```
If you’re using CentOS or any other Red Hat-based distribution:
```
sudo yum install mod_evasive
```
1. Configure mod\_evasive:
Now that mod\_evasive is installed, the configuration file can be edited to set the necessary parameters.
For Ubuntu:
```
sudo nano /etc/apache2/mods-enabled/evasive.conf
```
For CentOS:
```
sudo nano /etc/httpd/conf.d/mod_evasive.conf
```
Here’s what each setting does in the mod\_evasive configurations:
- DOSHashTableSize: This directive specifies the size of the hash table. Default is 3097.
- DOSPageCount: This is the threshold for the number of requests for the same page (or URI). This value sets the limit on the number of requests for the same page per IP address on a per second basis.
- DOSSiteCount: This is the threshold for total requests for any object by the same client IP on the same listener per second.
- DOSBlockingPeriod: The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blacklist. During this time, all subsequent requests from the client will result in a 403 (Forbidden) and the timer being reset (e.g. another 10 seconds).
Here is a sample configuration:
```
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
```
1. Save and exit the file
After you have made the changes, save the file and exit.
1. Test the configuration and restart Apache
After saving the changes, it is always good to test the configurations before restarting the Apache service.
For Ubuntu:
```
sudo apachectl configtest
```
If the syntax is OK, you can restart the Apache service.
```
sudo systemctl restart apache2
```
For CentOS:
```
sudo httpd -t
```
If the syntax is OK, you can restart the Apache service.
```
sudo systemctl restart httpd
```
Mod\_evasive should now be installed and enabled on your server. Keep an eye on your logs to adjust your settings as needed.
