Package: libapache2-mod-evasive
Version: 2.4.0-2
Severity: important
Dear Maintainer,
I have installed this package from the stable repository and the
current version does not allow to declare IP addresses to ignore
with the DOSWhitelist option.
I set the following minimal configuration by modifying the file
/etc/apache2/mods-enabled/evasive.conf:
DOSEnabled true
DOSWhitelist 127.0.0.1
DOSWhitelist ::1
(For information, the DOSEnabled is not available in the default
configuration file and can lead to misinterpretation, since the
default value is false).
After the reloading of the apache2 server, I expect the requests
from 127.0.0.1 to be ignored, but I can see the following entry
in the /var/log/apache2/error.log after some tests (with ab):
Blacklisting address 127.0.0.1: possible DoS attack.
I tried the version 2.4.0-3 from the testing repository and this
problem seems to be fixed.
-- System Information:
Debian Release: 13.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.111+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) (ignored:
LC_ALL set to fr_FR.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libapache2-mod-evasive depends on:
ii apache2-bin [apache2-api-20120211] 2.4.68-1~deb13u1
ii libc6 2.41-12+deb13u4
ii libpcre2-8-0 10.46-1~deb13u3
Versions of packages libapache2-mod-evasive recommends:
ii mailutils [mailx] 1:3.19-1
libapache2-mod-evasive suggests no packages.
-- Configuration Files:
/etc/apache2/mods-available/evasive.conf changed [not included]
-- no debconf information
