mod_evasive module is aimed at protection from HTTP DoS/DDoS attacks and brute force attacks.
Common settings for defending from DDoS attacks
#place this code in the httpd.conf <IfModule evasive_module> #optional directive (default value equals to 1024) DOSHashTableSize 1024 #obligatory directives (if even one of them is not set, malfunctioning is possible) DOSPageCount 10 DOSSiteCount 150 DOSPageInterval 1 DOSSiteInterval 1 DOSBlockingPeriod 10 </IfModule>
|DOSHashTableSize||specifies the size of hash table|
|DOSPageCount||sets the limit for the number of requests for the same page (or URI)|
|DOSSiteCount||sets the limit for the total number of requests for any object by the same client on the same listener|
|DOSPageInterval||sets the interval for the page count threshold|
|DOSSiteInterval||sets the interval for the site count threshold|
|DOSBlockingPeriod||sets the time that a client will be blocked for if they are added to the blocking list|
|DOSSystemCommand||pecifies the system command to be executed whenever an IP address becomes blacklisted|
|DOSCloseSocket||closes network connection socket if the directive state is On|
DOSHashTableSize directive defines the hash table size, i.e. the number of top-level nodes for each child’s hash table. Increasing this number will provide faster performance by decreasing the number of iterations required to get to the record, but will consume more memory for table space. It is advisable to increase this parameter on heavy load web servers.
#increase size of hash table for large servers DOSHashTableSize 2048
DOSPageCount directive sets the threshold for the number of requests for the same page (or URI) per page interval. Once the threshold for that interval has been exceeded, the client IP address is added to the blocking list.
DOSSiteCount directive sets the threshold for the total number of requests for any object by the same client on the same listener per site interval. Once the threshold for that interval has been exceeded, the client IP address is added to the blocking list.
DOSPageInterval directive sets the interval for the page count threshold. The interval is specified in seconds and may be a real number.
DOSSiteInterval directive sets the interval for the site count threshold. The interval is specified in seconds and may be a real number.
DOSBlockingPeriod directive sets the amount of time that a client will be blocked for if they are added to the blocking list. During this time, all subsequent requests from the client will result in 403 (Forbidden) response and the timer will be reset (e.g. for another 10 seconds). Since the timer is reset for every subsequent request, it is not necessary to have a long blocking period; in the event of a DoS attack, this timer will keep getting reset.
The interval is specified in seconds and may be a real number.
DOSSystemCommand directive specifies the system command to be executed whenever an IP address becomes blacklisted.
DOSSystemCommand "cscript addFirewallRuleByIP.vbs IP=%s"
DOSCloseSocket directive instructs mod_evasive to send 403 code and close connection socket. It means an attacker will have to create new connection and it’s pretty good for you as it takes some time.