Topic: mod_evasive :: Updated

[Steffen]

Apache mod_evasive (also formally known as Mod_dosevasive) helps to prevent HTTP DoS (DDoS) attacks or server brute force attacks. The module works it's magic by blocking access to your server from connections by the perpetrating single IP address that exceeded more than 50 concurrent connections to Apache or loading the same page more then a few times per second.

Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:

1. Requesting the same page more than a few times per second
2. Making more than 50 concurrent requests on the same child per second
3. Making any requests while temporarily blacklisted (on a blocking list)

The module will help protect against people sending too many requests to the webserver in an attempt to flood it. If it detects too many connections the offending ip will be blocked from the accessing apache for This is especially useful when the server is continuously getting attacked. With this default configuration it will block the offending ip for 10 minutes. If it continues to try and flood mod_evasive will automatically add more time to this.

Authors home at https://github.com/jvdmr/mod_evasive

Steffen

[admin]

The original author jzdziarski did not actively maintained the module anymore.

It is forked by jvdmr which is now the official repro, see https://github.com/jvdmr/mod_evasive

Documentation: https://github.com/jvdmr/mod_evasive/blob/master/README.md

Updated to the now official version 2.0, VS16 only.

Changes:

* Support for per-vhost configuration instead of only global
* Added DOSHTTPStatus directive
* evasive20_module is now simply called evasive_module
* Greg Smith's windows port added

When you update you have to change LoadModule evasive2_module modules/mod_evasive2.so to:

LoadModule evasive_module modules/mod_evasive.so

[Steffen]

Updated VS16 to version 2.2.0

In this release, added a new configuration option DOSWhitelistUri which takes a Perl-style regex and matches it against the request's URI. If it matches, the request is allowed and not counted towards the DOS limit.

[first_family]

DOSWhitelistUri is not working for me.

The error occurs:

[Steffen]

Oeps... Tested it, but not DOSWhitelistUri.

[spitzerspace]

The system command is called repeatedly during a DOS attack. I had to revise my script to check the log dir to see if it has already been called for a specific IP.

[jasch]

Any plans on updating the download so the DOSWhitelistUri works?

I keep getting "Invalid Command DOSWhitelistUri'

There's even a 2.3.0 out since March (the one on the donwloads page is 2.2.0 from Feb)

Thanks

[Steffen]

This feature not implemented. Author released it only in mod_evasive24.c not in mod_evasive24win.c .

It is reported, but no action by the author till now.

[Steffen]

Available for VS17

[kostya]

Could you please provide this version of mod_evasive?

[Steffen]

Note on the download page :

VS17 Win32 modules (like mod_fcgid) use VS16 ones at VS16 Win32 modules

[kostya]

But there is no VS16 binary for this module. Could you provide it?

[Steffen]

The link to VS16 is on the download page :

https://www.apachelounge.com/download/VS16/

[kostya]

thanks, will try it. Just to verify, will it work with apache version 2.4.58?

[Steffen]

Yes

[mrdj1024]

it appears 2.3.0 is out with a bugfix for windows,any chance we can get an updated module for windows?
https://github.com/jvdmr/mod_evasive/blob/main/CHANGELOG

[admin]

Thanks for the heads-up.

Please test https://www.apachelounge.com/download/VS17/modules/mod_evasive-2.3.0-win64.zip

[mrdj1024]

thankyou!! yes it works