HOW TO: mod_evasive

Sorantis · Feb 17, 2006

Hi All
When I'm running test.pl
I get

HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found
HTTP/1.1 302 Found

No HTTP/1.1 200 OK
Why so??

@how@ · Feb 17, 2006

I found this in googel HTTP/1.1 302 Found

10.3.3 302 Found

The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests. This response is only cacheable if indicated by a Cache-Control or Expires header field.

The temporary URI SHOULD be given by the Location field in the response. Unless the request method was HEAD, the entity of the response SHOULD contain a short hypertext note with a hyperlink to the new URI(s).

If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.

Note: RFC 1945 and RFC 2068 specify that the client is not allowed
to change the method on the redirected request. However, most
existing user agent implementations treat 302 as if it were a 303
response, performing a GET on the Location field-value regardless
of the original request method. The status codes 303 and 307 have
been added for servers that wish to make unambiguously clear which
kind of reaction is expected of the client.

cmichaelis · Apr 26, 2006

Hi there,

I was wondering if anybody here has attempted to use mod_evasive along with subversion through WebDAV - I've tried it, but I seem to accidentally block a few committers from time to time (gets midway through the commit, then dies with "403".) Surprisingly only a few times have checkouts been blocked.

Any thoughts welcome - including alternative solutions! Mostly I'm concerned about stopping people from running repeated "GET"s on the same file within a subversion repository; not sure if that's possible, however, while still allowing normal checkouts.

Thanks!
--Chris Michaelis

dubbah · May 3, 2006

DOSSystemCommand

Is there something you can say about the DOSSystemCommand directive? AFAIK mod_evasive is working on a per-children basis, thus is run as www-user, not root. mod_evasive is working fine, sends an email also (after configuring MAILER), but doen's seem to execute the system command. The comfiguration line is:

Code:

DOSSystemCommand "sudo /sbin/ipfw add 1 deny all from %s to any"

I've added www to sudoers file with

Code:

www ALL = (ALL) /sbin/ipfw

But nothing at all is logged about the command or an attempt to sudo when blacklisting. There is no way I can check it, so i am asking: can the www-user, which is created as

Code:

www:*:80:80:World Wide Web Owner:/nonexistent:/sbin/nologin

, use sudo? Or no one who can not login (/sbin/nologin) can use it?

Thanks in advance.

zigzam · May 19, 2006

How do I uninstall it?

nobaloney · May 19, 2006

Find the lines for it in /etc/httpd/conf/httpd.conf, and comment them out.

Then restart apache.

Jeff

dungman · May 26, 2006

After install mod_evasive and mod_security , i run test and get :

HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK

What's that ?. Before install mod_security , all is nornal .

Please help me , i don't understand

jsheeren · Jun 8, 2006

Hi all,
when i run test.pl i get the following:

Connection refused at ./test.pl line 12.

Connection to localhost is denied? How to solve this?
I also have mod_security installed....

How can i test mod_evasive?

@how@ · Jun 8, 2006

jsheeren said:
Hi all,
when i run test.pl i get the following:

Connection refused at ./test.pl line 12.

Connection to localhost is denied? How to solve this?
I also have mod_security installed....

How can i test mod_evasive?

did you chmod ?

Code:

chmod 755 test.pl

jsheeren · Jun 8, 2006

yes i have chmodded test.pl

can it be that i have disabled apache to listen on 127.0.0.1:80?

i think that is the problem, because in the test.pl script

PHP:

 PeerAddr=> "127.0.0.1:80");

I will change my httpd.conf so that apache also listens on localhost...

I'll keep you all informed...

jsheeren · Jun 8, 2006

yes, that was it:

[root@meddb conf]# /root/mod_evasive/test.pl
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 404 Not Found
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden

that 404 not found; i think that's mod_security.....

thx

@how@ · Jun 8, 2006

mod_security work fine with mod_evasive
take look to mod_security rules.

jsheeren · Jun 8, 2006

hi,
mod_security is supposed to do that according to my rules.

here's what mod_sec says:
GET /?41 HTTP/1.0
mod_security-message: Access denied with code 404. Pattern match "^$" at HEADER("USER-AGENT") [severity "EMERGENCY"]
mod_security-action: 404

HTTP/1.1 404 Not Found

so everything workes as it should
i am happy

grtz

felosi · Jun 17, 2006

guys this mod evasive is not the best thing for dos and socket floods, it just gives the attacker a 403 not to mention while under attack it drives your load very high. I have seen a script that uses that to write to iptables though but in my experience you cannot have no better dos protection then apf and dos deflate. You can get the dos deflate here http://projects.medialayer.com/ddos.html

Im sure everyone knows where to get apf. Anyway this is much better protection and it bans them from firewall

Remco00 · Jun 25, 2006

DOSWhitelist 127.0.0.1

First I get this:

[root@s01 mod_evasive]# ./test.pl
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
[root@s01 mod_evasive]#

And than, after adding DOSWhitelist 127.0.0.1, I get only HTTP/1.1 200 OK like this:

[root@s01 mod_evasive]# ./test.pl
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
[root@s01 mod_evasive]#

Remco00 · Jun 25, 2006

Never mind, overlooked that ofcourse I get only HTTP/1.1 200 OK of whitelisted 127.0.0.1. Using an external IP shows that mod_evasive indeed works like a charm. Thanks Wael!

@how@ · Jun 25, 2006

Remco00 said:
Never mind, overlooked that ofcourse I get only HTTP/1.1 200 OK of whitelisted 127.0.0.1. Using an external IP shows that mod_evasive indeed works like a charm. Thanks Wael!

U R welcome

Remco00 · Jun 25, 2006

advise

Weal, what is your advise? I now use mod-evasive and mod-security in combination with kiss (installed as mentioned in your great how-to's). Should I also install dos deflate and do they all work together without known problems?

@how@ · Jun 25, 2006

Re: advise

Remco00 said:
Weal, what is your advise? I now use mod-evasive and mod-security in combination with kiss (installed as mentioned in your great how-to's). Should I also install dos deflate and do they all work together without known problems?

Kiss, mod-evasive, mod-security, D-DOS atacks all work fine

Remco00 · Jun 28, 2006

mod_evasive & frontpage

I know mod_evasive does not work well together with FP extensions installed. However, I found this info:

---

I am assuming that you would be using Frontpage to allow a small group of people to upload files. With this in mind, you can tweak mod_evasive in 2 ways -

1) Use the whitelist directive to tell mod_evasive to ignore those authorized addresses who are using frontpage, and/or

2) Tweak the DOSSiteCount/DOSSiteInterval and DOSPageCount/DOSPageInterval ratios to a threshold that will allow frontpage to work but will still trigger when some launches a DoS attack.

I had to tweak these settings in my environment to allow some of our own web monitoring tools to work.

---

What would be acceptable values used for the DOSSiteCount/DOSSiteInterval and DOSPageCount/DOSPageInterval ratios?

HOW TO: mod_evasive

Verified User

Verified User

New member

New member

New member

NoBaloney Internet Svcs - In Memoriam †

New member

New member

Verified User

New member

New member

Verified User

New member

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User