Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am on a VPS (CentOs) running Apache and I would like to install Mod_Evasive. The problem is that I follow the installation steps without error but Apache doesn't load the module. Here are the step that I have done.

1) wget http://www.zdziarski.com/blog/wp-content/uploads/2010/02/mod_evasive_1.10.1.tar.gz

2) tar xzf mod_evasive_1.10.1.tar.gz

3) cd mod_evasive

4) apxs -cia mod_evasive20.c

5) nano /etc/httpd/conf/mod_evasive.conf

6) paste that in the .conf:

   <IfModule mod_evasive20.c>
   DOSHashTableSize 3097
   DOSPageCount  2
   DOSSiteCount  50
   DOSPageInterval 1
   DOSSiteInterval  1
   DOSBlockingPeriod  10
   DOSLogDir   /var/log/mod_evasive
   DOSEmailNotify  admin@email.com
   DOSWhitelist   127.0.0.1
   </IfModule>

7) nano /etc/httpd/conf/httpd.conf Add :

 LoadModule evasive20_module modules/mod_evasive20.so
 Include "/etc/httpd/conf/mod_evasive.conf"

8) mkdir /var/log/mod_evasive

9) /etc/init.d/httpd restart

10) php -r 'phpinfo();' | grep -i evasive

The last command show nothing about mod_evasive. What am I doing wrong?

share|improve this question
    
@dok Did you check httpd error log for any errors –  LINUX4U Oct 24 '12 at 7:14
    
@SandeepKrishnan yes and I haven't see any error concerning evasive –  Patrick Desjardins Oct 25 '12 at 0:17
add comment

2 Answers

10) php -r 'phpinfo();' | grep -i evasive

This command only shows information about your PHP stack, it does not talk to Apache or mod_evasive().

To have server info on your phpinfo(); you have to run it from a server, so watch the output from a browser.

Or use

apachectl -M

(Instead of apachectl, you may need to put apache2 or apache2ctl, depending on your installation)

share|improve this answer
    
Alright, but phpinfo() from a browser doesn't contain anything regarding mod_evasive neither. –  Patrick Desjardins Oct 24 '12 at 13:48
    
The module being loaded should be enough. Check also in the logs, maybe mod_evasive writes something in it. If it's a standard Apache installation with mod_evasive, running a slowloris attack should be enough to test. If the server stays up during the attack and after, it means that mod_evasive works well. See ha.ckers.org/slowloris –  pistache Oct 25 '12 at 6:13
add comment

You added mod_evasive to Apache and then checked if it existed in PHP on the command line. phpinfo() in a browser is different from phpinfo() on the command line.

Try apachectl -M

share|improve this answer
    
Alright, but phpinfo() from a browser doesn't contain anything regarding mod_evasive neither. –  Patrick Desjardins Oct 24 '12 at 13:46
    
And what did apachectl -M show? –  Ladadadada Oct 24 '12 at 14:14
    
evasive20_module (shared) is in the list of module. Does it means that it's running with the setting set in the configuration file? I do not see any way to figure out how well it's working or not. –  Patrick Desjardins Oct 25 '12 at 0:13
    
That means that it's definitely loaded into Apache. To test it, you could try triggering its rules. Running curl in a loop or ab (probably with some amount of concurrency) from your home connection should be enough to get it to block you. –  Ladadadada Oct 25 '12 at 10:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.