hi all,
I confirm the main parts of Filipe's analysis:
* 2.4.0-2 in trixie has no effect in identifying suspicious IPs
* 1.10.1-5 forwardported from bookworm is effective in identifying suspicious
IPs.
I have not tested 2.4.0-3.
I have not empirically estimated the effective value of DOSBlockingPeriod.
DETAILS:
OS: Debian/trixie
$ dpkg -l |grep apache2 |grep ^ii
ii apache2 2.4.69-1~deb13u1
amd64 Apache HTTP Server
ii apache2-bin 2.4.69-1~deb13u1
amd64 Apache HTTP Server (modules and other binary files)
ii apache2-data 2.4.69-1~deb13u1
all Apache HTTP Server (common files)
ii apache2-dev 2.4.69-1~deb13u1
amd64 Apache HTTP Server (development headers)
ii apache2-utils 2.4.69-1~deb13u1
amd64 Apache HTTP Server (utility programs for web servers)
ii libapache2-mod-auth-plain 2.0.54
amd64 Module for Apache2 which provides plaintext
authentication
ii libapache2-mod-evasive 1.10.1-5
amd64 evasive module to minimize HTTP DoS or brute force
attacks
ii libapache2-mod-fcgid 1:2.3.9-4
amd64 FastCGI interface module for Apache 2
ii libapache2-mod-perl2 2.0.13-2+b2
amd64 Integration of perl with the Apache2 web server
ii libapache2-mpm-itk 2.4.7-04-2
amd64 multiuser module for Apache
ii libapache2-reload-perl 0.14-1
all module for reloading Perl modules when changed on
disk
1. Testing libapache-mod-evasive-1.10.1.5 forward ported from bookworm to
trixie.
SOURCES:
28130db5133df5ea1d8d451fa65c12e8 libapache-mod-evasive_1.10.1-5.debian.tar.xz
2f0b8695e7054ef32b471bd1b7e8bf23 libapache-mod-evasive_1.10.1-5.dsc
69e829d1364894f1bb3a5ce9401bddd3 libapache-mod-evasive_1.10.1.orig.tar.gz
$ fakeroot debian/rules binary
...
# dpkg -i libapache2-mod-evasive_1.10.1-5_amd64.deb
1a. CONFIG:
$ grep -vE "^ *#|^ *$" /etc/apache2/mods-enabled/evasive.conf
<IfModule mod_evasive20.c>
DOSPageCount 2
DOSPageInterval 1
DOSLogDir "/var/log/mod_evasive"
</IfModule>
1b. CHECK EFFECT:
# systemctl stop apache2 && systemctl start apache2 && apachectl -M |grep
evasive
evasive20_module (shared)
# ls -lt /var/log/mod_evasive/|head
[This shows several entries with filenames dos-aa.bb.cc.dd created just now.]
2. Replace by the trixie version.
$ dpkg -s libapache2-mod-evasive
Package: libapache2-mod-evasive
Status: install ok installed
Priority: optional
Section: httpd
Installed-Size: 63
Maintainer: Christian Göttsche <[email protected]>
Architecture: amd64
Source: libapache-mod-evasive
Version: 2.4.0-2
Depends: apache2-api-20120211, apache2-bin (>= 2.4.16), libc6 (>= 2.38),
libpcre2-8-0 (>= 10.22)
Recommends: bsd-mailx | mailx
Conffiles:
/etc/apache2/mods-available/evasive.conf 4d5949954238adc0b9422a8b238985e9
/etc/apache2/mods-available/evasive.load c2707f7fa8d0abe86b4ab1eec6d85e05
Description: evasive module to minimize HTTP DoS or brute force attacks
mod_evasive is an evasive maneuvers module for Apache to provide some
protection in the event of an HTTP DoS or DDoS attack or brute force attack.
.
It is also designed to be a detection tool, and can be easily configured to
talk to ipchains, firewalls, routers, and etcetera.
.
This module only works on Apache 2.4 servers
Homepage: https://github.com/jvdmr/mod_evasive
2a.1 With the same config as for 1a, there is no effect:
# ls -lt /var/log/mod_evasive/|head
[Only shows the (old) entries from 1a.]
2a.2 CONFIG without the "20" (for apache 2.0):
# grep -vE "^ *#|^ *$" /etc/apache2/mods-enabled/evasive.conf
<IfModule mod_evasive.c>
DOSPageCount 2
DOSPageInterval 1
DOSLogDir "/var/log/mod_evasive"
</IfModule>
# systemctl stop apache2 && systemctl start apache2 && apachectl -M |grep
evasive
evasive_module (shared)
# ls -lt /var/log/mod_evasive/|head
[Still only shows the (old) entries from 1a.]
3. Returning to 1. with
# dpkg -i libapache2-mod-evasive_1.10.1-5_amd64.deb
again gave effective detections of suspicious IPs.
Thus, for me:
* 2.4.0-2 in trixie has no effect in identifying suspicious IPs
* 1.10.1-5 forwardported from bookworm is effective in identifying suspicious
IPs.
Cheers
Boud
