Prevent DDoS Attack With mod_evasive in Apache 2

Getting hit by a DDoS attack is a very annoying thing. Besides making your server slower, it can take your server down entirely. DDoS (Distributed Denial of Service) is an attempt to attack a target server with a flood of requests from many sources, to make the target server busy and then bring it down. DDoS attacks come in many forms but basically flood the target server with high and CPU-consuming requests to eventually make the server malfunction or go down.

You can prevent DDoS attacks by using mod_evasive in Apache 2. mod_evasive is an Apache module that provides evasive action in the event of an HTTP DoS or DDoS (Denial of Service) attack or brute force attack against the web server. When possible attacks are detected, mod_evasive will block traffic from the source for a specific duration of time, and reports abuses via email and syslog facilities. mod_evasive can also be configured to talk to iptables, ipchains, firewalls, routers, etc. to build a comprehensive DDoS prevention system for a high-traffic busy web server.

To install mod_evasive

1. Open your terminal or remotely log in to your server via SSH.

2. Download the mod_evasive module:

cd /opt/
wget http://www.zdziarski.com/blog/wp-content/uploads/2010/02/mod_evasive_1.10.1.tar.gz

3. Extract it:

tar -zxvf mod_evasive_1.10.1.tar.gz
cd mod_evasive

4. Install mod_evasive:

/usr/local/apache/bin/apxs -cia mod_evasive.c

5. Open httpd.conf:

vim /usr/local/apache/conf/httpd.conf

#Add this lines

DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 600
DOSLogDir "/var/log/httpd/"
DOSEmailNotify [email protected]

6. Save and exit the httpd.conf Apache configuration file.

7. Restart Apache:

/etc/init.d/htpd restart

There are many ways to configure mod_evasive. See the manual configuration details below:

DOSHashTableSize
Size of the hash table. The greater this setting, the more memory is required for the lookup table, but the faster the lookups are processed. This option will automatically round up to the nearest prime number.

DOSPageCount
Number of requests for the same page within the DOSPageInterval interval that will get an IP address added to the blocking list.

DOSSiteCount
Same as DOSPageCount, but corresponds to the number of requests for a given site, and uses the DOSSiteInterval interval.

DOSPageInterval
Interval for the DOSPageCount threshold in second intervals.

DOSSiteInterval
Interval for the DOSSiteCount threshold in second intervals.

DOSBlockingPeriod
Blocking period in seconds if any of the thresholds are met. The user will receive a 403 (Forbidden) when blocked, and the timer will be reset each time the site gets hit while the user is still blocked.

DOSEmailNotify
If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted. A locking mechanism using /tmp prevents continuous emails from being sent.

PS: mod_evasive is not the only way to prevent DDoS attacks, and it is not guaranteed to be a perfect way to stop an attacker.