Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many simultaneous connections which triggers blacklisting behaviour in mod_evasive. Is there any way to exclude PDFs from mod_evasive tracking? Am I using too restrictive config? I understand that every deployment is somewhat different but I am looking for suggestions. I want to stop sending 403 on partial downloads requests.

Here is the log

[Tue Dec 31 09:47:37 2013] [error] [client 70.180.65.28] client denied by server configuration: /srv/netce/Root/pdfs/catalogs/productid_3078.pdf
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 403 1018 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 2560 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 1024 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 4096 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"

Here is mod_evasive config

LoadModule evasive20_module modules/mod_evasive20.so
<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        5
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
    DOSEmailNotify      admins@mysite.com
    DOSLogDir           "/var/www"
    DOSWhitelist   127.0.0.1
    DOSWhitelist   192.168.*
</IfModule>

Any help is appreciated.

share|improve this question

1 Answer 1

After writing up this question I started researching and looking for a solution. I found a work around that basically just disables partial downloads. It's not the most efficient solution but it seems to work.

<LocationMatch "\.pdf$">
 Header unset Accept-Ranges
</LocationMatch>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.