APACHE dan MOD_EVASIVE ( HTTP/DDOS PROTECTION )

mod_evasive biasa digunakan untuk bertindak terhadap HTTP DoS or DDoS attack or brute force attack

download latest version mod_evasive dari http://www.zdziarski.com/projects/mod_evasive/

#tar -zxvf mod_evasive-xxx
#cd mod_evasive-xxx

A) sekiranya anda guna apache 1.3x lakukan

#apxs -iac mod_evasive.c
#pico /etc/apache/httpd.conf

masukkan


DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify kawe@kawe.com
DOSSystemCommand "sudo /sbin/iptables -A INPUT -s %s -j DROP"
DOSLogDir "/var/lock/mod_evasive"


save dan exit

#visudo
masukkan ( tukar apache dengan user apache anda )

apache ALL= NOPASSWD: /sbin/iptables -A INPUT -s [0-9.]* -j DROP

:wq

restart Apache 1.3x

B) Jika versi apache 2.x

#apxs -i -a -c mod_evasive.c
#pico /etc/apache/httpd.conf

masukkan


DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify kawe@kawe.com
DOSSystemCommand "sudo /sbin/iptables -A INPUT -s %s -j DROP"
DOSLogDir "/var/lock/mod_evasive"


save dan exit

#visudo
masukkan ( tukar apache dengan user apache anda )

apache ALL= NOPASSWD: /sbin/iptables -A INPUT -s [0-9.]* -j DROP

:wq

restart Apache 2.x


ok dah siap.. utk testing...

run :-

#perl test.pl

test.pl ada dalam folder mod_evasive tadi. output yang anda akan dapat..

HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 200 OK
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden
HTTP/1.1 403 Forbidden