2

I am getting a lot of false positives notices sent by mod_evasive installed on my apache servers. They always happen on large PDF file downloads. When clients download PDFs from my site, they use many simultaneous connections which triggers blacklisting behaviour in mod_evasive. Is there any way to exclude PDFs from mod_evasive tracking? Am I using too restrictive config? I understand that every deployment is somewhat different but I am looking for suggestions. I want to stop sending 403 on partial downloads requests.

Here is the log

[Tue Dec 31 09:47:37 2013] [error] [client 70.180.65.28] client denied by server configuration: /srv/netce/Root/pdfs/catalogs/productid_3078.pdf
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 403 1018 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 2560 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 1024 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
70.180.65.28 - - [31/Dec/2013:09:47:37 -0800] "GET /3078/Catalog_MD14.pdf HTTP/1.1" 206 4096 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"

Here is mod_evasive config

LoadModule evasive20_module modules/mod_evasive20.so
<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        5
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
    DOSEmailNotify      [email protected]
    DOSLogDir           "/var/www"
    DOSWhitelist   127.0.0.1
    DOSWhitelist   192.168.*
</IfModule>

Any help is appreciated.

Improve this question

1 Answer 1

Reset to default
1

After writing up this question I started researching and looking for a solution. I found a work around that basically just disables partial downloads. It's not the most efficient solution but it seems to work.

<LocationMatch "\.pdf$">
 Header unset Accept-Ranges
</LocationMatch>
Improve this answer
2
  • This "solves" the problem by introducing a new one.
    – cherouvim
    Oct 14, 2016 at 9:55
  • Just wanted to thank you for remembering to post this solution, btw for Apache, this is the code that worked for me: <Files *.pdf> Header set Accept-Ranges none </Files>
    – DeZeA
    Jul 21, 2017 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .