Mod_evasive Is It Good To Install
Nov 27, 2008and is it good to install or not?[url]
View 5 Replies
ADVERTISEMENT
Error On Install Mod_evasive
Mar 25, 2009i want to install mod on my centos Cpanel server. so i try:
cd /usr/local/src
wget mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/sbin/apxs -cia mod_evasive20.c
but when i run /usr/sbin/apxs -cia mod_evasive20.c there is some error for me :
[root@ mod_evasive]#/usr/sbin/apxs -cia mod_evasive20.c
-bash: /usr/sbin/apxs: No such file or directory
How To Install Mod_security, Suhosin, Mod_Evasive On Server Plesk (apache2, Php5)
Jul 26, 2007how to install mod_security, suhosin, Mod_Evasive on server plesk (apache2, php5)?
win I loacate apxs I have empty results
Good UK Host For Joomla Self Install
Sep 1, 2008I have a client who is UK based and whose readership will be mostly UK based.
They want to use Joomla and have asked me to install and configure.
I don't anticipate high traffic or needing lots of space, just need a reliable responsive host, probably UK based.
I don't want to use Fantastico automatic install. I prefer to install myself.
SSH desirable but not essential.
Mod_evasive
Jun 21, 2007I know this can be the most foolishly question on WHT but I'm looking for mod_evasive's download link, I tried googling and searching all forums but all links was dead
anybody can give me a link to get mod_evasive ? Ofcourse If you have a better idea than using of mod_evasive I'll be glad to hear
Mod_evasive
Oct 14, 2007We installed mod_evasive and ever since we are getting files like: dos-xxx.xxx.xxx.xxx, where xxx.xxx.xxx.xxx is an IP in our /tmp directory. The contents of the file is usually a 4 or 5 digit number and is owned by apache. Can anyone help me understand what this file is? Is it a product of mod_evasive? Can the files be deleted?
View 14 Replies View RelatedMod_evasive Log Content
Mar 24, 2008I have a file named dos-1.2.13.4 (i changed the IP address in purpose) inside the log and inside the file there is a 4 digit number that is constantly changing. more
[root@myserver]# more dos-1.2.13.4
8726
What is 8726?
Mod_evasive Installation
Feb 25, 2008We are having problem with installing mod_evasive on our server. We tried installing it on our Virtual Machine that runs Fedora 7 (on our server, we have Fedora core 5), and on Virtual Machine it is fine, we can compile it and put it in our Apache2 conf file.
However, when we try
[root@ mod_evasive]# /usr/local/psa/admin/bin/apxs -i -a -c mod_evasive20.c
on the server, we get a
[root@ mod_evasive]# /usr/local/psa/admin/bin/apxs -i -a -c mod_evasive20.c
gcc -DHARD_SERVER_LIMIT=512 -DDEFAULT_PATH="/usr/local/psa/admin/bin:/bin:/usr/bin" -DLINUX=22 -DTARGET="httpsd" -DHAVE_SET_DUMPABLE -DNO_DBM_REWRITEMAP -DMOD_SSL=208122 -DEAPI -O -pipe -I/usr/include -O3 -fexpensive-optimizations -fstrength-reduce -pipe -DPLESK_Linux -I/home/builder/buildbot/psa-8.2.1-bfc7/build/plesk/lib/dist/include/libxml2 -W -Wall -DPLESK_Linux -I/home/builder/buildbot/psa-8.2.1-bfc7/build/plesk/plesk-utils/include -DBSG_CR -DBSG_MSG -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DHAS_RPM -DUSE_SLEEP_ON_IDLE -Wno-unused-parameter -fpic -DSHARED_MODULE -I/usr/local/psa/admin/include -c mod_evasive20.c ....
Testing Mod_Evasive
Apr 2, 2007I have 2 questions here.
1. I have installed mod_evasive version 1.10.1 on a Cent OS 4.4 server.
I'm using the test.pl script that comes with mod_evasive to test the configuration and when running the script from the same server mod_Evasive is installed. The mod_evasive is able to detect the intrusion and block the IP of the server.
If I use the same test.pl script from an external server the requests come in and are viewable in the access log but mod_evasive doesnt block the IP of the external server. Probably is not blocing the ip of the external server because of latency.
Is there a way to modify the test.pl script to make it more agressive and get results when testing from an external server?
Here I'm pasting the code of the test.pl script:
Code:
#!/usr/bin/perl
# test.pl: small script to test mod_dosevasive's effectiveness
use IO::Socket;
use strict;
for(0..100) {
my($response);
my($SOCKET) = new IO::Socket::INET( Proto => "tcp",
PeerAddr=> "test.domain.tld:80");
if (! defined $SOCKET) { die $!; }
print $SOCKET "GET /?$_ HTTP/1.0
";
$response = <$SOCKET>;
print $response;
close($SOCKET);
}
2. Also, I have sendmail installed and on the mod_evasive config I have email address specified on DOSEmailNotify. When testing from the internal server with the test.pl script the server is able to block the ip, put in the hash table but it never sends an email to my email address.
Mod_evasive Settings
Mar 30, 2007mod_evasive settings?
I cant find out the setting which would ban all bad IPs and will nto ban normal ones.
Mod_Evasive Rules
Apr 1, 2007Does anyone know any good mod_evasive rules that pick up DoS, but not many false positives? Just looking to see what works for everyone out there, been having trouble.
Or if there is better apache module to combat DoS.
Mod_Evasive - Testing Remotely
Apr 10, 2007I have 2 questions here.
1. I have installed mod_evasive version 1.10.1 on a Cent OS 4.4 server.
I'm using the test.pl script that comes with mod_evasive to test the configuration and when running the script from the same server mod_Evasive is installed. The mod_evasive is able to detect the intrusion and block the IP of the server.
If I use the same test.pl script from an external server the requests come in and are viewable in the access log but mod_evasive doesnt block the IP of the external server.
Probably is not blocing the ip of the external server because of latency.
Is there a way to modify the test.pl script to make it more agressive and get results when testing from an external server?
Here I'm pasting the code of the test.pl script:
Quote:
#!/usr/bin/perl
# test.pl: small script to test mod_dosevasive's effectiveness
use IO:ocket;
use strict;
for(0..100) {
my($response);
my($SOCKET) = new IO:ocket::INET( Proto => "tcp",
PeerAddr=> "test.domain.tld:80");
if (! defined $SOCKET) { die $!; }
print $SOCKET "GET /?$_ HTTP/1.0
";
$response = <$SOCKET>;
print $response;
close($SOCKET);
}
2. Also, I have sendmail installed and on the mod_evasive config I have email address specified on DOSEmailNotify. When testing from the internal server with the test.pl script the server is able to block the ip, put in the hash table but it never sends an email to my email address.
Mod_Evasive Enhancing Reporting
Apr 27, 2007I got mod_evasive installed and its working fine. Its detecting the IPs, blocking the IPs and sending me the emails.
The emails I'm getting only have the sender name "Apache" and the content shows the IP address is blocking.
How can I enhance the email report to display the following:
1) get a proper Subject header in the email
2) change the From header to include the hostname - i.e.
apache@web.domain.tld
3) have the program do a reverse lookup on the ip, and include that in the body.
Do I need to include a script using the DOSSystemCommand to do this?
Mod_Evasive - Testing Remotely
Apr 11, 2007I have 2 questions here.
1. I have installed mod_evasive version 1.10.1 on a Cent OS 4.4 server.
I'm using the test.pl script that comes with mod_evasive to test the configuration and when running the script from the same server mod_Evasive is installed. The mod_evasive is able to detect the intrusion and block the IP of the server.
If I use the same test.pl script from an external server the requests come in and are viewable in the access log but mod_evasive doesnt block the IP of the external server. Probably is not blocing the ip of the external server because of latency.
Is there a way to modify the test.pl script to make it more agressive and get results when testing from an external server?
Here I'm pasting the code of the test.pl script:
Quote:
#!/usr/bin/perl
# test.pl: small script to test mod_dosevasive's effectiveness
use IO:Socket;
use strict;
for(0..100) {
my($response);
my($SOCKET) = new IO:Socket::INET( Proto => "tcp",
PeerAddr=> "test.domain.tld:80");
if (! defined $SOCKET) { die $!; }
print $SOCKET "GET /?$_ HTTP/1.0
";
$response = <$SOCKET>;
print $response;
close($SOCKET);
}
2. Also, I have sendmail installed and on the mod_evasive config I have email address specified on DOSEmailNotify. When testing from the internal server with the test.pl script the server is able to block the ip, put in the hash table but it never sends an email to my email address.
Mod_Evasive - Blocking IPs Manually
Oct 26, 2007Is there a way to block ips with mod_evasive by adding the ips to the mod_evasive configuration file?
View 3 Replies View RelatedMod_evasive And Black List
Jul 9, 2007Some times I read in logs
server mod_evasive[24203]: Blacklisting address 84.255.151.xxx: possible attack.
Where can I find this black list and all IP listed
Errror When Restarting Httpd Mod_evasive
May 5, 2008Installing mod_evasive after serveral attacks on our server.
but when restarting httpd I get this error,
httpd: Syntax error on line 36 of /usr/local/apache/conf/httpd.conf: API module structure 'evasive20_module' in file /usr/lib/httpd/modules/mod_evasive20.so is garbled - expected signature 41503232 but saw 41503230 - perhaps this is not an Apache module DSO, or was compiled for a different Apache version?
Running apache 2.2.8
Installing Mod_evasive On Cpanel Server
Jun 23, 2008I would like to install the Mod_evasive for Apache 2.0 on RHEL 4 Server(Cpanel Installed). I downloaded the Mod_evasive source and extracted and used the following command.
# cd mod_evasive
# /usr/sbin/apxs -cia mod_evasive20.c
I am getting folowing message.
-bash: /usr/sbin/apxs: No such file or directory
# whereis apxs
apxs:
Mod_evasive Doesn't Protect From Apache DOS
Feb 6, 2008We tried to use one software for offline browsing to download our site and test it if it will fail or not. We used 500 threads at once. Program was able to request 56 pages per second. Of course server (site) failed because there were no more available mysql connections. So site went down. Mod_evasive didn't block that.
Here is the config:
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 80
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 30
DOSLogDir "/var/log/httpd"
</IfModule>
Here is the copy of text I found on one site about mod_evasive:
Mod_evasive does work relatively well for small to medium sized brute force or HTTP level DoS attacks. There is, however, an important limitation that mod_evasive has that you should be aware of. The mod_evasive module is not as good as it could be because it does not use shared memory in Apache to keep information about previous requests persistent. Instead, the information is kept with each child process or thread. Other Apache children that are then spawned know nothing about abuse against one of them. When a child serves the maximum number of requests and dies, the DoS information goes with it. So, what does this mean? This means that if an attacker sends their HTTP DoS requests and they do not use HTTP Keep-Alives, then Apache will spawn a new child process for every request and it will never trigger the mod_evasive thresholds. This is not good…
Is there any solution for such type of attack with Keep Alive disabled?
Mod_evasive Bans Some Legit Apps
Dec 10, 2007mod_evasive bans some of the legit users (galleries , typo3 etc.) with following settings:
<IfModule mod_dosevasive20.c>
DOSHashTableSize 3097
DOSPageCount 10
DOSSiteCount 150
DOSPageInterval 1
DOSSiteInterval 3
DOSBlockingPeriod 10
</IfModule>
Somebody have an idea for some less restrictive but still usefull rules?
Mod_evasive Suggestion For High Traffic Server
Mar 12, 2008The server gets around 25k unique visitors per day, but one website in particular allows hotlinking and uses a lot of bandwidth. Last time I checked...according to whm apache status page, I was getting 180 requests per second. Not sure what time it was though. So it might be higher at a different time of the day.
Recently got mod_evasive installed, but I didn't want it to block out legitimate users. Currently it's set to this...
<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 10
DOSBlockingPeriod 600
</IfModule>
what a better configuration would be? When I run the log I already see it block out a bunch of IP's. I don't want to lose any visitors to this program, but I do get ddos a lot.
Lighttpd Mod_evasive Setting Up A Specific Conditional
Oct 24, 2007I just started using lighttpd for download purpose.
I limited the number of connection per ip to 5 using mod_evasive .
When a user is downloading with a download manager the number of connection is reached to its maximum. I was wondering if there is a way to allow that same user to be able have 1 additional connection when an index.php is requested . That is, if the user is trying to view an index.php file it would ignore the rule evasive.max-conns-per-ip = 5 .
Each user have their download dir located on [url] in that same dir contains an index.php which contains login tab and integrated directory listing .
List Of Good Hosters With Good TELEPHONE Tech Support
May 6, 2008I'd like to start an ongoing thread here listing the 'Good Hosters with Good TELEPHONE tech support'. In other words, out of the 1,000s of host companies, this may cut it down to less than a dozen.
( And for all you Hosters out there who really want your company to grow, and want to know how, - it's easy: just read here.)
Good telephone support is the #1 ultimate requirement, because:
-It's a lot faster and easier for both the user and the host company, because you can state and answer all questions and clarifications on the spot, you don't need to continually pass new emails with new questions and clarifications, back and forth for days on end, until the issue is solved. It saves tech time and user's time. And saves a lot of nerves.
- It's the best way to sort the good guys from the bad. A bad company isn't going to bother to answer the phone, - or will make you wait way too long, - because they are likely getting endless complaints. The good guys are always ready to answer the phones, with a friendly voice, - because they really WANT to please the customer.
- If a company can't be bothered to pick up the phone, we can't be bothered to even consider them. They're a joke, and so won't be listed here on this thread. (So, before adding or listing any Hosters here, please verfify that they do have Good, quick, friendly, telephone support,; ideally 24/7, but 9am to 10pm might be acceptable, if it was supplemented by some emergency contact.
AND:
- Hoster ALSO needs good EMAIL support (and preferably, Chat online, extended hour availability). (I spend a lot of time overseas). It sems all emails should get a non-automated response within about an hour, - and then support should jump on fixing any problem.
I only need support a few times a year. To answer some questions, or fix a problem, or do an install. That's lesss than 1 hour total, so any company paying maybe $18/hour tech support should be able to handle this. It IS reasonable to charge a custm for extended calls, beyond say, 90minutes a year, IF you don't count the 80%? Of times an issue is the Hoster;s fault of stmg gone wrong, and don't count the 'hold' times.
ALSO IMPORTANT:
- Uptime
- site Speeds
- Monthly plans, no contract (Only a dishonest host will try to force you into a contract, where they can then ignore you.)
- Reasonable price. (? Maybe $12 to $18/month for a basic business site. We don't need massive bandwitdths, - we all know that's an overselling scam, and can't ever be delivered.)
- a good upgrade plan of bigger options. Maybe even VPS.
- Dedicated IP, and availbility of SSL
-PHP 5, mysql, phpMyAdmin, etc
- cPanel ( Some Hosts are using problematic panels, like Hsphere, which are slow to load, slow in operation, require many more clicks, have too many options, spread apart on many separate pages. Time is money, and this really slows down the ability of a small business to manage his own site in effective time. For example, one WHT user wrote somewhere: "I don't feel that HSphere's interface is nice at all, although I have worked with cPanel and DA all my life... I just found it to include un-necessary features or split features up in to different hard to find pages, such as backups - mysql backups you had to find on a completely different page than file backups, and then there were options to have it in the home directory or server-end backup, in which then you had to wait a good 10 minutes before it was ready. cPanel, just hit backup and hit download and instantly it does everything you need...".
I have used several hosters. Currently on Aplus.net and Godad, which have phone support, and mediocre service.
My LIST So Far:
- Liquidweb: a very impressive company with good, 24 hour support. But to get dedicated IP, you need to go with their $25/month plan. Yikes!
- NewIdeaHosting.com. A very small company. My call was returned, and the owner chatted with me for an hour on the phone! Plans have small bandwidth, but promises No overselling, and personalized attention. Extra $5 for dedi IP. He specializes in Small business sites, and small eCommerce sites. He has only 250 accounts, on 3 servers. He rents servers from the Equinox data center of Chicago. Seems exceptionaly honest.
- MegaHosters. Excellent phone support and WHT reviews. But company was taken over by another company, and so may well go downhill in future. Another problem: uses Hsphere.
- Steadfast. Has a good rep on WHT, and seems impressive. Tech answered the phone immediately, but they say they prefer emails. Sales phone has limited hours. Good price on $20 SSL. But, uses Hshhere.
- JodoHost 24 hour phone. But, uses Hsphere. An Indian company with office in Florida, and good rep. I like the idea of outsourcing phone support, if it makes it more available and affordable. But, the accent on the phone was very hard for me to understand, so maybe this might not work.....
- Hostgator. Yes, it's a big overseller, but seems to get good reviews/results anyway, and good phone support.
- ? ThePrimeHost ?? Mostly good WHT reviews; some dissenters. Site says 24hour phone, but when I called on several nights, no one ever answered...
- Can anyone add to this list? Please list only hosts that meet the above minimum requirements of phone support, etc. Especially useful is hosters you've tried.
TO AVOID:
- Avoid Arvixe. I had a horrid experience with them, here: [WHT forum]:/showthread.php?p=5097822#post5097822
- Avoid WebHostingBuzz. This company never returned my phone msessage inquiries.
Plesk 12.x / Linux :: Possible To Install To Debian Jessie With Auto-install Script?
Jul 19, 2015Is it possible to install Plesk 12 to Debian Jessie with the autoinstall script?
View 7 Replies View RelatedGood Avocado Really Good
Oct 20, 2008Any experience with Good Avocado and their reseller plan?
What about Thinkhost, good avocado is partnering with?
Wind and solar energy, it sounds all good, the reseller plan is awesome.
Any real life experience?
Install Suhosin :: How I Can Install Mod_security
Nov 14, 2008problem with install suhosin and ...
how i can install Mod_security
Yum Install Php Or Manually Install Php
Aug 8, 2008What difference between yum install php or manually install php from scrach (build, make and install)?
I know manually install could configure lots of parameters and paths, like --iconv, --mbsting, etc. I don't know anything behind yum install php. If I want to install php everything in the following:
./configure --prefix=/usr/local/webserver/php --with-config-file-path=/usr/local/webserver/php/etc --with-mysql=/usr/local/webserver/mysql --with-mysqli=/usr/local/webserver/mysql/bin/mysql_config --with-iconv-dir=/usr/local --with-freetype-dir --with-jpeg-dir --with-png-dir --with-zlib --with-libxml-dir=/usr --enable-xml --disable-debug --disable-rpath --enable-discard-path --enable-safe-mode --enable-bcmath --enable-shmop --enable-sysvsem --enable-inline-optimization --with-curl --with-curlwrappers --enable-mbregex --enable-fastcgi --enable-fpm --enable-force-cgi-redirect --enable-mbstring --with-mcrypt --with-gd --enable-gd-native-ttf --with-openssl --with-sendmail=/usr/sbin/sendmail
How Do I Install With RPM To Install Dependencies Also
Jul 22, 2008to installing linux software and have been beating my head for a couple of days. I just learned that I can use something on my CENTOS 5 - which is the same as RHEL 5 - to install the rpm and all dependencies.
Numeric-24.2-1.i586.rpm is the rpm I want to install, if that matters.
How can I do install it AND any dependencies?
Kernel Source Install Help Needed On Fc6 X64I Am Trying To Install The Kernel Source.
May 13, 2007I am trying to install the kernel source.
I have downloaded kernel-2.6.20-1.2948.fc6.src.rpm
I am using fedora 6 64bit.
here are my current kernels:
kernel-headers-2.6.20-1.2948.fc6
kernel-devel-2.6.20-1.2944.fc6
yum-kernel-module-1.0.3-1.fc6
kernel-2.6.20-1.2944.fc6
kernel-devel-2.6.20-1.2948.fc6
kernel-2.6.20-1.2948.fc6
here is what I seen when I installed kernel-2.6.20-1.2948.fc6.src.rpm
rpm -ivh kernel-2.6.20-1.2948.fc6.src.rpm
1:kernel warning: user brewbuilder does not exist - using root
warning: group brewbuilder does not exist - using root
warning: user brewbuilder does not exist - using root
########################################### [100%]
warning: user brewbuilder does not exist - using root
warning: group brewbuilder does not exist - using root
then when I ran:
rpmbuild -bp --target=$(uname -m) /usr/src/redhat/SPECS/kernel-2.6.spec
I seen this error:
+ Arch=x86_64
+ make ARCH=x86_64 nonint_oldconfig
In file included from /usr/include/sys/socket.h:35,
from /usr/include/netinet/in.h:24,
from /usr/include/arpa/inet.h:23,
from scripts/basic/fixdep.c:117:
/usr/include/bits/socket.h:310:24: error: asm/socket.h: No such file or directory
make[1]: *** [scripts/basic/fixdep] Error 1
make: *** [scripts_basic] Error 2
error: Bad exit status from /var/tmp/rpm-tmp.93770 (%prep)
I need to have this installed to get a app installed etc...
suggestions or ideas?
thanks
Good UK VPS
Dec 1, 2008I have dedicated servers - which are overkill as I only host 10 sites (small). I am now looking to move to a VPS solution and would like to know if anyone can recommend a good UK company (that offers true UK hosting) with good uptime and support?
Cpanel and Unix VPS, but may also require windows vps - so a company that offers both will be beneficial, but long term view to migrate over to Linux