Moved from Stackoverflow.
I have a LAMP server running Ubuntu with security programs such as Denyhosts, Fail2ban and with Mod_security installed but seem to constantly be the target of a DDOS attack. Here is a section of the access.log:
83.57.208.254 - - [07/Oct/2013:12:44:32 +0100] "POST / HTTP/1.1" 200 14225 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
71.234.72.17 - - [07/Oct/2013:12:44:33 +0100] "POST / HTTP/1.1" 200 14225 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
77.242.132.166 - - [07/Oct/2013:12:44:36 +0100] "POST / HTTP/1.1" 200 14227 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
41.215.148.226 - - [07/Oct/2013:12:44:37 +0100] "POST / HTTP/1.1" 200 14227 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
193.95.115.254 - - [07/Oct/2013:12:44:37 +0100] "POST / HTTP/1.1" 200 4621 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
77.252.113.238 - - [07/Oct/2013:12:44:37 +0100] "POST / HTTP/1.1" 200 14225 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
203.125.241.10 - - [07/Oct/2013:12:44:40 +0100] "POST / HTTP/1.1" 200 14259 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
202.3.84.79 - - [07/Oct/2013:12:44:40 +0100] "POST / HTTP/1.1" 200 14248 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
125.60.156.222 - - [07/Oct/2013:12:44:42 +0100] "POST / HTTP/1.1" 200 14233 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
41.194.49.44 - - [07/Oct/2013:12:44:44 +0100] "POST / HTTP/1.1" 200 14258 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
79.211.175.35 - - [07/Oct/2013:12:44:45 +0100] "POST / HTTP/1.1" 200 14258 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
109.86.12.76 - - [07/Oct/2013:12:44:46 +0100] "POST / HTTP/1.1" 200 14258 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
84.121.39.44 - - [07/Oct/2013:12:44:47 +0100] "POST / HTTP/1.1" 200 14259 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
86.148.77.223 - - [07/Oct/2013:12:44:49 +0100] "POST / HTTP/1.1" 200 14259 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
Based on http://systembash.com/content/how-to-stop-an-apache-ddos-attack-with-mod_evasive/ this appears to be a "Sloworis" attack and is happening constantly. I have installed Mod_evasive but because it only seems to be 1 request a second from unique IP addresses it hasn't made any difference.
When other genuine users are on other sites at the same time Apache seems to get too many child processes and hang, needing to be restarted although I am not sure if they are related.
Are there any ways of tuning Apache to help prevent this from taking place?
Thanks for any help.