3

I currently have a custom implementation in PHP/mysql that keeps track of web hits and blocks those that exceed a certain rate for the same IP. I.e. if a given source IP hits the server more than X times in the last Y seconds then it will be served a redirect to a predefined location Z and the normal request processing will be aborted.

It works OK, but puts significant stress on MySQL.

So I was wondering if there is a special tool for this available? Maybe an Apache module or some kind of filter?

7

The best

  • mod_evasive (Focused more on reducing DoS exposure)
  • mod_cband (Best featured for 'normal' bandwidth control)

and the rest

One more option - mod_qos

Not simple to configure - but powerful.

http://opensource.adnovum.ch/mod_qos/

  • Thanks. mod_evasive seems to only serve 403 responses for blocked addresses, but mod_cband looks promising! – rustyx Sep 23 '13 at 12:16
  • 4
    Note that this answer is a verbatim copy of stackoverflow.com/questions/131681/…. Don't plagiarize other peoples answers without attribution. – Sven May 1 '18 at 14:31
4

you may be able to do this at a lower level with iptables and bypass apache/mysql all together.... match and forward to another host / port? i have only dropped:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 6 -j DROP
  • So anyone can DOS you by filling that little "6 conns per minute" bucket? – Michuelnik Nov 24 '14 at 17:02
  • This bucket is per IP, no? – rustyx Apr 21 '15 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.