Knowledgebase

`mod_evasive` is an Apache module that helps prevent denial-of-service (DoS) attacks by detecting and blocking suspicious activity. To install `mod_evasive` on Ubuntu 22.04, follow these steps:

1. Update Your Package List
First, update your package list to ensure you have the latest information on available packages:

bash

sudo apt update

2. Install `mod_evasive`
You can install the `mod_evasive` module using the following command:

bash

sudo apt install libapache2-mod-evasive

3. Configure `mod_evasive`
After installation, you need to configure the module to suit your needs. Open the configuration file:

bash

sudo nano /etc/apache2/mods-available/evasive.conf

Here, you can adjust the settings according to your security requirements. Some key parameters include:

• `DOSHashTableSize`: Defines the size of the hash table that stores the IPs of users making requests.
• `DOSPageCount`: Sets the maximum number of requests a user can make for the same page within a certain timeframe.
• `DOSSiteCount`: Limits the total number of requests a user can make to the entire site within a given timeframe.
• `DOSBlockingPeriod`: Specifies how long an IP will be blocked after triggering a limit.

Example Configuration

DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSBlockingPeriod 10
DOSEmailNotify youremail@example.com
DOSSystemCommand "iptables -A INPUT -s %s -j DROP"

This configuration limits a user to 2 requests per second for a specific page, 50 requests per second for the entire site, and blocks them for 10 seconds if they exceed the limit. It also sends an email notification to `youremail@example.com` and blocks the IP using `iptables`.

4. Enable `mod_evasive`
To enable the `mod_evasive` module in Apache, use the following command:

bash

sudo a2enmod evasive

5. Restart Apache
Finally, restart Apache to apply the changes:

bash

sudo systemctl restart apache2

6. Test the Installation
You can create a simple script to test whether `mod_evasive` is working. Save the following script as `test.sh` and execute it:

bash

#!/bin/bash
for i in {1..100}; do
curl http://localhost/ > /dev/null &
done

If `mod_evasive` is configured correctly, you should see that after a few requests, access is denied.

Now your Apache server should be protected by `mod_evasive`.