Install mod_evasive(DDOS protection tool) on 64 bit linux machine

Mod_evasive is an evasive maneuvers module for Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection tool, and can be easily configured to talk to ipchains, firewalls, routers.


 [root@tester] updatedb; locate apxs | grep bin

/usr/local/apache/bin/apxs

cd /usr/local/src
wget http://www.sfr-fresh.com/unix/privat/mod_evasive_1.10.1.tar.gz
tar -zxvf mod_evasive_1.10.1.tar.gz
cd mod_evasive

[root@tester mod_evasive]# httpd -v
Server version: Apache/2.2.22 (Unix)
Server built:   Mar 22 2012 11:58:57

or apache 2.0.x :

/usr/sbin/apxs -cia mod_evasive20.c //integrating with apache.

Then add these in httpd.conf :
DOSHashTableSize 3097
DOSPageCount 6
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600

 For apache 1.3.x :

/usr/local/apache/bin/apxs -cia mod_evasive.c //integrating with apache.

Then add this too httpd.conf
DOSHashTableSize 3097
DOSPageCount 6
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600

[root@tester mod_evasive]# /usr/sbin/apxs -cia mod_evasive20.c


[root@tester mod_evasive]# chmod 755 /usr/lib/apache/mod_evasive20.so

[root@tester mod_evasive]#  grep -i evasive /etc/httpd/conf/httpd.conf
LoadModule evasive20_module   /usr/lib/apache/mod_evasive20.so

[root@tester mod_evasive]#  php -r 'phpinfo();' | grep -i evasive
PWD => /usr/local/src/mod_evasive
_SERVER["PWD"] => /usr/local/src/mod_evasive
_ENV["PWD"] => /usr/local/src/mod_evasive

vi /etc/httpd/conf/httpd.conf

<IfModule mod_dosevasive20.c>
DOSHashTableSize    3097
DOSPageCount        1
DOSSiteCount        50
DOSPageInterval     1
DOSSiteInterval     1
DOSBlockingPeriod   10
DOSEmailNotify      root
#  DOSSystemCommand    “su – someuser -c ‘/sbin/… %s …’”
#  DOSLogDir           “/var/tmp/doslog”
#Leave this commented while testing, then un comment once you are sure the module works
# DOSWhitelist    127.0.0.1
</IfModule>


Restart apache
 /etc/init.d/httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd:                                             [  OK  ]

Fields details are below:

DOSHashTableSize:

The hash table size defines the number of top-level nodes for each child’s hash table. Increasing this number will provide faster performance by decreasing the number of iterations required to get to the record, but consume more memory for table space

DOSPageCount:

This is the threshold for the number of requests for the same page (or URI) per page interval. Once the threshold for that interval has been exceeded, the IP address of the client will be added to the blocking list.

DOSSiteCount:

This is the threshold for the total number of requests for any object by the same client on the same listener per site interval.

DOSPageInterval

The interval for the page count threshold; defaults to 1 second intervals.

DOSSiteInterval
The interval for the site count threshold; defaults to 1 second intervals.

DOSBlockingPeriod
The blocking period is the amount of time (in seconds) that a client will be blocked for if they are added to the blocking list. During this time, all subsequent requests from the client will result in a 403 (Forbidden) and the timer being reset (e.g. another 10 seconds).

DOSEmailNotify
  If this value is set, an email will be sent to the address specified whenever an IP address becomes blacklisted. A locking mechanism using /tmp prevents continuous emails from being sent.

DOSSystemCommand
If this value is set, the system command specified will be executed whenever an IP address becomes blacklisted. This is designed to enable system calls to ip filter or other tools.

DOSLogDir
Choose an alternative temp directory, default is /tmp.

SPRI (System Priority)

SPRI (System Priority) is a utility designed to que different processes with
different priority levels based on 3 class levels of importance (high,med,low).

The problem? Linux has priority levels to thread all tasks at, these prio's
are ranged from -20 to +19 with 0 as the default for all processes. So this
being the fact, with everything operating at prio 0 you got fights between
services as to who gets what resources first.

Solution? Very simply, que different processes at different priority levels
to effectively discipline the system on who gets what resource access first.

The average load level of a server can be substantialy decreased by using spri,
by as much as 5-20%, of course results may vary.

To install SPRI, execute the following commands (as root):

wget http://www.r-fx.ca/downloads/spri-current.tar.gz
md5sum spri-current.tar.gz | cut -d ‘ ‘ -f1

The md5sum should be like ef3e4c82b7473bf921e7a470ece037ff  

If not, then delete the file and download again.

tar -zxvf spri-current.tar.gz

cd spri-0.5

./installer.sh

cd ..

rm -rf spri*

The changes we need to make are as follows (done as root):
Edit /usr/local/spri/prios/med and ensure that it contains the processes qmail, MailScanner and spamd
Edit /usr/local/spri/prios/med-high and ensure that it contains the processes mysqld and mysqld-max 
Edit /usr/local/spri/prios/low and ensure that it contains the processes awffull, clamav, clamdscan, freshclam and python2.2
Edit /usr/local/spri/prios/low-med and ensure that it contains the processes php, php-script and proftpd

Run SPRI by executing the command: /usr/local/sbin/spri -v.

SPRI will set the priorities of the processes defined and ensure they 

are run at their set priorities.

EG: It will display like below. 

[root@tester]# /usr/local/sbin/spri -v
SPRI 0.5 [spri@r-fx.org]
========================
list file '/usr/local/spri/prios/rt' appears empty, nothing done for PRIO -2.

Setting httpd to priority 4:
5406: old priority 0, new priority 4
5409: old priority 0, new priority 4
5410: old priority 0, new priority 4
5411: old priority 0, new priority 4
5412: old priority 0, new priority 4
5413: old priority 0, new priority 4
9612: old priority 0, new priority 4

Setting mysqld to priority 6:
4551: old priority 0, new priority 6

Setting mysqld-max to priority 6:
No processes for mysqld-max running.

Setting squid to priority 6:
No processes for squid running.

Setting sendmail to priority 8:
No processes for sendmail running.

Setting MailScanner to priority 8:
No processes for MailScanner running.

Setting spamd to priority 8:
No processes for spamd running.

Setting ocwhttpd to priority 8:
No processes for ocwhttpd running.

Setting cppop to priority 8:
No processes for cppop running.

Setting cpanel to priority 8:
No processes for cpanel running.

Setting webmaild to priority 8:
No processes for webmaild running.

Setting php to priority 10:
No processes for php running.

Setting php-script to priority 10:
No processes for php-script running.

Setting proftpd to priority 10:
25358: old priority 0, new priority 10

Setting pure-ftpd to priority 10:
No processes for pure-ftpd running.

Setting urchinwebd to priority 12:
No processes for urchinwebd running.

Setting java to priority 12:
No processes for java running.

Setting tomcat to priority 12:
No processes for tomcat running.

Setting clamav to priority 12:
No processes for clamav running.

Setting clamscan to priority 12:
No processes for clamscan running.

Setting freshclam to priority 12:
No processes for freshclam running.

Setting rsync to priority 12:
No processes for rsync running.

Setting python2.2 to priority 12:
No processes for python2.2 running.

Setting ensim-python to priority 12:
No processes for ensim-python running.

Setting eximstats to priority 12:
No processes for eximstats running.