DirectAdmin Forums

Go Back   DirectAdmin Forums > Modifications / Add-ons > How-To Guides
Reload this Page HOW TO: mod_evasive
Register FAQ Calendar Search Today's Posts Mark Forums Read

Reply
Page 1 of 3 1 23
 
Thread Tools Display Modes
  #1  
Old 12-08-2005, 06:53 PM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
Thumbs up HOW TO: mod_evasive
Post move here
__________________


Web for host serving the web since 2004

((( update.script ))) help you to upgrade
OpenSSL / Exim / OpenSSH / ProFTP / phpMyAdmin / MySQL / SquirrelMail
AVG Anti-Virus / Clam Anti-Virus / MODclamAV / MRTG / SpamAssassin / IMAP
SquirrelMail / MODsecurity / MODsecurity Rules / MODevasive / MailScanner
KISS My Firewall / eAccelerator / Freetype / Control panel Webmin
Last edited by @how@; 08-26-2009 at 04:59 AM.
Reply With Quote
  #2  
Old 12-09-2005, 01:46 PM
sspt sspt is offline
Verified User
  
Join Date: Oct 2005
Posts: 63
Very nice How to @How@ Tks

Just one thing that i should post:

Apache 2.0.xx
cp mod_evasive20.c /usr/local/directadmin/customapache/
Apache 1.3.xx
cp mod_evasive.c /usr/local/directadmin/customapache/

Apache 2.0.xx
/usr/sbin/apxs -cia ./mod_evasive20.c
Apache 1.3.xx
/usr/sbin/apxs -cia ./mod_evasive.c
Reply With Quote
  #3  
Old 12-09-2005, 06:37 PM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
Thumbs up
welcome sspt & thanks for add Apache 2.0.xx , Apache 1.3.xx
Reply With Quote
  #4  
Old 12-20-2005, 04:17 AM
MartijnHOS MartijnHOS is offline
Verified User
  
Join Date: Jun 2005
Location: Netherlands
Posts: 58
Hello,

I want to install mod_evasive. Already i have installed APF and BFD. Does BFD gives conflicts with mod_evasive? Or do i have to uninstall BFD as it is not necessary anymore?

Kind regards,

Martijn
Reply With Quote
  #5  
Old 12-20-2005, 04:23 AM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
Quote:
Originally posted by MartijnHOS
Hello,

I want to install mod_evasive. Already i have installed APF and BFD. Does BFD gives conflicts with mod_evasive? Or do i have to uninstall BFD as it is not necessary anymore?

Kind regards,

Martijn
APF & BFD & mod_evasive work fine no need to uninstall BFD.


Wael
Reply With Quote
  #6  
Old 12-20-2005, 04:25 AM
MartijnHOS MartijnHOS is offline
Verified User
  
Join Date: Jun 2005
Location: Netherlands
Posts: 58
OK, thanks for your reply
Reply With Quote
  #7  
Old 12-23-2005, 05:48 AM
hehachris's Avatar
hehachris hehachris is offline
Verified User
  
Join Date: Nov 2004
Location: Hong Kong
Posts: 593
1 thing i m concerning is that will this module add extra loading to the CPU?
Reply With Quote
  #8  
Old 12-23-2005, 07:09 AM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
Quote:
Originally posted by hehachris
1 thing i m concerning is that will this module add extra loading to the CPU?
No
Reply With Quote
  #9  
Old 01-17-2006, 02:19 AM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
test
Code:
[root@server1 customapache]# cd /root/mod_evasive
[root@server1 mod_evasive]# chmod 755 test.pl
[root@server1 mod_evasive]# ./test.pl
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden



Wael
Reply With Quote
  #10  
Old 01-26-2006, 07:13 AM
snaaps snaaps is offline
Verified User
  
Join Date: Jan 2005
Location: Netherlands
Posts: 221
I have installed this module
people attack my server by http dos,
(see also http://www.directadmin.com/forum/sho...hlight=reading)

The module blocks nothing and I will not recieve a mail.
700 httpd reqest in 1 second!

I placed the code above:

<IfModule mod_evasive.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify info@myexdomain.nl
</IfModule>

ClearModuleList
#AddModule mod_mmap_static.c
blablablabla.........
Reply With Quote
  #11  
Old 01-26-2006, 11:24 AM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
after install you need to run test
./test.pl
and if you see all HTTP/1.1 200 OK it is mean you need to fix it or lock like this it mean install ok
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden


this mod help you but you need to run anti-dos and mod_security to keep you box safe 80%
there is no 100%



Wael
Reply With Quote
  #12  
Old 02-09-2006, 03:22 PM
yoavz yoavz is offline
Verified User
  
Join Date: Jul 2005
Posts: 10
I can't get it working.

tried for like 5 times.

i'm always getting "200 OK".

what's the problem?
Reply With Quote
  #13  
Old 02-09-2006, 07:04 PM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
1- search in /etc/httpd/conf/httpd.conf
did you fine this file mod_evasive.so
2- search in your server for mod_evasive.so

if you find this file in server and you did not find it in httpd.conf you need to install it again or start this tip
upload mod_evasive.so to
Code:
/usr/lib/apache/
and
Code:
/usr/local/directadmin/customapache/
upload mod_evasive.o and mod_evasive.c to
Code:
/usr/local/directadmin/customapache/
then edit httpd.conf
Code:
nano -w /etc/httpd/conf/httpd.conf
after this
Code:
LoadModule perl_module        /usr/lib/apache/libperl.so
add
Code:
LoadModule evasive_module     /usr/lib/apache/mod_evasive.so
after this
Code:
<IfDefine HAVE_PYTHON>
AddModule mod_python.c
</IfDefine>
add
Code:
AddModule mod_evasive.c
after this
Code:
ExtendedStatus On
add
Code:
<IfModule mod_evasive.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
</IfModule>
save and restart httpd
Code:
Run TEST



Wael
Reply With Quote
  #14  
Old 02-09-2006, 07:09 PM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
mod_evasive.so & mod_evasive.o & mod_evasive.c in Zip file (Attach)
Last edited by @how@; 01-09-2008 at 01:53 AM.
Reply With Quote
  #15  
Old 02-09-2006, 10:17 PM
yoavz yoavz is offline
Verified User
  
Join Date: Jul 2005
Posts: 10
it's working now!

thanks alot!!
Reply With Quote
  #16  
Old 02-09-2006, 10:47 PM
@how@'s Avatar
@how@ @how@ is offline
Verified User
  
Join Date: Mar 2005
Location: Kingdom of Bahrain
Posts: 860
Thumbs up
U R welcome


Wael
Reply With Quote
  #17  
Old 02-10-2006, 01:43 AM
telecart telecart is offline
Verified User
  
Join Date: Apr 2005
Location: Israel
Posts: 15
is there any site i can learn about the parameters?

(DOSHashTableSize,DOSPageCount,DOSSiteCount, etc.)

Daniel.
Reply With Quote
  #18  
Old 02-10-2006, 01:52 AM
telecart telecart is offline
Verified User
  
Join Date: Apr 2005
Location: Israel
Posts: 15
nevermind,
google is sure helpful

DOSHashTableSize
Size of the hash table. The greater this setting, the more memory is required for the look up table, but also the faster the look ups are processed. This option will automatically round up to the nearest prime number.

DOSPageCount
Number of requests for the same page within the 'DOSPageInterval' interval that will get an IP address added to the blocking list.

DOSSiteCount
Same as 'DOSPageCount', but corresponds to the number of requests for a given site, and uses the 'DOSSiteInterval' interval.

DOSPageInterval
Interval for the 'DOSPageCount' threshold in second intervals.

DOSSiteInterval
Interval for the 'DOSSiteCount' threshold in second intervals.

DOSBlockingPeriod
Blocking period in seconds if any of the thresholds are met. The user will recieve a 403 (Forbidden) when blocked, and the timer will be reset each time the site gets hit when the user is still blocked.
Reply With Quote
  #19  
Old 02-10-2006, 07:32 PM
servertweak's Avatar
servertweak servertweak is offline
Verified User
  
Join Date: Feb 2005
Posts: 293
hello,
mod_evasive HTTP Blacklisted 127.0.0.1

how can i fix this to allow and not to block local address
__________________
ServerTweak Networks, LLC ServerTweak.com
ServerTweak.com: Premium Services, Powered by Customers.
Fremont & Los Angeles Locations | RAID 10 Dedicated Servers | Colocation | IP Transit | 1/4 - Full Cab & Cages sales
Reply With Quote
  #20  
Old 02-16-2006, 08:54 AM
rocketcity's Avatar
rocketcity rocketcity is offline
Verified User
  
Join Date: Aug 2005
Posts: 159
This information came from the README file for mod_evasive.
-----------------------------------------------------------------------
WHITELISTING IP ADDRESSES

IP addresses of trusted clients can be whitelisted to insure they are never
denied. The purpose of whitelisting is to protect software, scripts, local
searchbots, or other automated tools from being denied for requesting large
amounts of data from the server. Whitelisting should *not* be used to add
customer lists or anything of the sort, as this will open the server to abuse.
This module is very difficult to trigger without performing some type of
malicious attack, and for that reason it is more appropriate to allow the
module to decide on its own whether or not an individual customer should be
blocked.

To whitelist an address (or range) add an entry to the Apache configuration
in the following fashion:

DOSWhitelist 127.0.0.1
DOSWhitelist 127.0.0.*

Wildcards can be used on up to the last 3 octets if necessary. Multiple
DOSWhitelist commands may be used in the configuration.
__________________
=GB=
Rocket City Hosting
www.rocketcityhosting.com
Reply With Quote
Reply
Page 1 of 3 1 23

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Forum Jump


All times are GMT -7. The time now is 07:48 AM.

Contact Us - DirectAdmin Web Control Panel - Archive - Top

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
DirectAdmin © 2007 JBMC Software