How To Enable mod_evasive To Log & Report DOS Attack And BruteForce Attack On Apache

Senior Web Developer, HostAdvice CTO 2 min read

May 31, 2024 11:11 PM

mod_evasive is a module for Apache that automatically takes action when an HTTP DoS attack or brute force attack is detected. It is used to make logs and alert for issues.

This module creates a list of URLs and IP addresses and the users who fall in the condition set in the configuration, these users will receive a 403 error. In this guide, you will learn how you can enable this feature for CentOS, Ubuntu, Debian.

Prerequisites

Apache server
Text editor

Step 1:

To install the mod_evasive module you will need the httpd-devel package.

It contains the file needed to build Dynamic Shared Objects for Apache. Run the following command to install httpd-devel package.

yum install httpd-devel

Used for CentOS

apt-get install apache2-utils

This command is used for Ubuntu & Debian

Step 2:

Download the mod_evasive module using the wget command in your terminal

cd /usr/src
wget http://www.zdziarski.com/blog/wp-content/uploads/2010/02/mod_evasive_1.10.1.tar.gz

Extract the downloaded module

tarxzfmod_evasive*.tar.gz

Now, go inside the extracted foler.

cd mod_evasive

Step 3:

Now you need to install a tool called apxs2.

It is used along with Apache for building and installing added functionality.

apxs2-ciamod_evasive20.c

This command will not run if httpd-devel is not installed properly.

Step 4:

Download and install the epel repository to move ahead.

yum install epel-release

After the installation of the epel repository, install mod_evasive using

yum install mod_evasive

Step 5:

You can now verify if the module has been added to the Apache functionality or not.

Open your configuration file to check if the module has been added or not.

The configuration file is located at a different location for a different operating system.

For Ubuntu/Debian,

/etc/apache2/apache2.conf

For CentOS,

/etc/httpd/conf/httpd.conf

In Ubuntu, add the following line at the end of the config file

LoadModule evasive20_module /usr/lib/httpd/modules/mod_evasive20.so

For CentOS, Search for Include and look for

Include mods-enabled/*.conf

Add the above lines for each Operating system if they are not available in the config file.

Step 6:

To set the rule for DOS count and DOS interval and other settings, add the following code to the same config file from Step 5.

<IfModulemod_evasive20.c>
    DOSHashTableSize 4012
    DOSPageCount 3
    DOSSiteCount 50
    DOSPageInterval 1
    DOSSiteInterval 1
    DOSBlockingPeriod 70
    DOSEmailNotify <test@example.com>
</IfModule>

This config will send an alert to the mentioned email address if the DOS attack meets the above set configuration.