HowTo: Mod_throttle for DA

[jmstacey]

Mod_Throttle for DA

Date: July 29, 2004
Tested on FreeBSD 4.10
-------------------------------------------------------

1. Download and unpack mod_throttle
wget http://www.snert.com/Software/mod_throttle/mod_throttle312.tgz
tar -zxf mod_throttle132

2. Make a second level backup of the httpd.conf because the compile will rewrite it. It will make a backup with httpd.conf.bak so this is just a precausionary measure since I don't like my programs rewriting any config files without warning me ahead of time.

3. Build DSO module
cd (pathto)/mod_throttle-1.3
make install

4. Restore backed up httpd.conf otherwise any changes you have made to it will be lost

5. Modify the httpd.conf file with the following. The httpd.conf DA used will probably have some of this. Make sure the following is already in there, if its not put it in the correct locations.
<IfDefine HAVE_THROTTLE>
LoadModule throttle_module modules/mod_throttle.so
</IfDefine>
and
<IfDefine HAVE_THROTTLE>
AddModule mod_throttle.c
</IfDefine>


Now add the following:

<IfModule mod_throttle.c>
ThrottlePolicy none

<Location /throttle-status>
SetHandler throttle-status
</Location>

<Location /throttle-me>
SetHandler throttle-me
</Location

<Location /~*/throttle-me>
SetHandler throttle-me
</Location>
</IfModule>

6. Save the httpd.conf file and restart apache
FreeBSD: /usr/local/etc/rc.d/httpd restart
RedHat: /sbin/service httpd restart


7. Test and see if it work!
www.yourdomain.com/throttle-status
If there is information there you can not set up mod_throttle to do what it was meant for.

Configuration Instructions can be found here:
http://www.snert.com/Software/mod_throttle/#Configuration

--------------------------------------------------------------------------

Sub-How-To
A requested feature is how to limit the number of accesses from a single ip, here is how you do it.

1. Setting the Policy for the entire server to only allow 10 requests from a single ip address in a 5 minute period
Open the httpd.conf file again and change the "ThrottlePolicy none" line to
ThrottleClientIP 100 Request 10 5m

After 5 requests within a 5 minute period the user will receive a 503 Service temporarily Unavailable error message

What does it mean?
This is the format that is used
ThrottleClientIP size policy limit period

Size = The size of the list The period of time that a client IP address is tracked depends on the size of the client IP address list, which is ordered most recent request to oldest. Every time a new client IP address connects, the oldest entry in the list is lost and reassigned to the new client IP address. Every time an existing entry makes a request, it is moved to the top of the list.
policy = The Policy we wanted to use. In this How-To we used the request policy to limit the number of requests. The number to limit to is in the limit section=
limit = The limit that applies to the policy
period = The period is a number followed by an optional suffix s, m, h, d, or w for seconds, minutes, hours, days, or weeks respectively. When no suffix is given the default is seconds.

Please visit http://www.snert.com/Software/mod_throttle for a complete list of policies that you can use.

[Dr-Host]

Thanks alot

altho setting it to 10 is to low

i've set it to ClientIP 200 Request 100 5m

and so far its working fine

Thanks again

[jmstacey]

Yeah that was a thing to make sure it was working since its really easy to reach that limit. I don't recommend using it.

Its to bad the directive can't be used on virtualhosts and must be set global :rolleyes:

[Dr-Host]

the weird thing is that its working fine for 3-6 min and after that its like the apache is stuck and needs to be restarted

I'll try messing with the limit

[jmstacey]

What Oprating system are you running? There was a note on the installation gude on snert that depending on the OS your using you may have to change the memory utiliztion. See the installation instructions there for details.

[Dr-Host]

I'm using RH9 but I don't think its that the diffrent OS Settings are the issue

[jmstacey]

Its worth a try at least.
Try #define one of these instead of the default during compile time in the mod_throttle.c file.

USE_FCNTL_SERIALIZATION
USE_FLOCK_SERIALIZATION

Any errors in the error log? Whats you system memory usage like, high usage? Maybe try setting your ip list smaller so it doesn't require so much resources.