I am on a VPS (CentOs) running Apache and I would like to install Mod_Evasive. The problem is that I follow the installation steps without error but Apache doesn't load the module. Here are the step that I have done.

1) wget http://www.zdziarski.com/blog/wp-content/uploads/2010/02/mod_evasive_1.10.1.tar.gz

2) tar xzf mod_evasive_1.10.1.tar.gz

3) cd mod_evasive

4) apxs -cia mod_evasive20.c

5) nano /etc/httpd/conf/mod_evasive.conf

6) paste that in the .conf:

   <IfModule mod_evasive20.c>
   DOSHashTableSize 3097
   DOSPageCount  2
   DOSSiteCount  50
   DOSPageInterval 1
   DOSSiteInterval  1
   DOSBlockingPeriod  10
   DOSLogDir   /var/log/mod_evasive
   DOSEmailNotify  admin@email.com

7) nano /etc/httpd/conf/httpd.conf Add :

 LoadModule evasive20_module modules/mod_evasive20.so
 Include "/etc/httpd/conf/mod_evasive.conf"

8) mkdir /var/log/mod_evasive

9) /etc/init.d/httpd restart

10) php -r 'phpinfo();' | grep -i evasive

The last command show nothing about mod_evasive. What am I doing wrong?

  • @dok Did you check httpd error log for any errors – LINUX4U Oct 24 '12 at 7:14
  • @SandeepKrishnan yes and I haven't see any error concerning evasive – Patrick Desjardins Oct 25 '12 at 0:17

10) php -r 'phpinfo();' | grep -i evasive

This command only shows information about your PHP stack, it does not talk to Apache or mod_evasive().

To have server info on your phpinfo(); you have to run it from a server, so watch the output from a browser.

Or use

apachectl -M

(Instead of apachectl, you may need to put apache2 or apache2ctl, depending on your installation)

  • Alright, but phpinfo() from a browser doesn't contain anything regarding mod_evasive neither. – Patrick Desjardins Oct 24 '12 at 13:48
  • The module being loaded should be enough. Check also in the logs, maybe mod_evasive writes something in it. If it's a standard Apache installation with mod_evasive, running a slowloris attack should be enough to test. If the server stays up during the attack and after, it means that mod_evasive works well. See ha.ckers.org/slowloris – pistache Oct 25 '12 at 6:13

You added mod_evasive to Apache and then checked if it existed in PHP on the command line. phpinfo() in a browser is different from phpinfo() on the command line.

Try apachectl -M

  • Alright, but phpinfo() from a browser doesn't contain anything regarding mod_evasive neither. – Patrick Desjardins Oct 24 '12 at 13:46
  • And what did apachectl -M show? – Ladadadada Oct 24 '12 at 14:14
  • evasive20_module (shared) is in the list of module. Does it means that it's running with the setting set in the configuration file? I do not see any way to figure out how well it's working or not. – Patrick Desjardins Oct 25 '12 at 0:13
  • That means that it's definitely loaded into Apache. To test it, you could try triggering its rules. Running curl in a loop or ab (probably with some amount of concurrency) from your home connection should be enough to get it to block you. – Ladadadada Oct 25 '12 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.