Vahid
2008/07/13, 17:56
اين ماژول که روي Apache نصب ميشه از ارسال تعداد زياد request هاي ناخواسته به web server جلوگيري مي کنه . اين تنظيماتي که اينجا نوشته شده از حملات DOS براي 10 دقيقه براي هر ip جلوگيري مي کنه توجه داشته باشيد وارد کردن عدد بالا به جاي اين 10 دقيقه ممکنه باعث بشه بعضي از کاربران هم واقعا attacker نيستند جلوشون گرفته بشه .
اگر نسخه Apache 1.3.x داريد :
----command-----
cd /usr/local/src
wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/local/apache/bin/apxs -cia mod_evasive.c
-----command-----
اگر نسخه ي Apache 2.0.x داريد:
-----command-----
up2date -i httpd-devel
cd /usr/local/src
wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/sbin/apxs -cia mod_evasive20.c
-----command
حالا بايد اين ماژول رو در تنظميات apache تون اضافه کنيد و تنظيمات لازمش رو انجام بديد : (براي apache 1.3.x )
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600
تنضيمات httpd.conf براي نسخه ي apache 2.0.x (توجه داشته باشيد نسخه رو درست انتخاب کنيد)
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 10
DOSBlockingPeriod 600
اینم نمومه کپی یکی از دستورات SSH
login as: root
root@***.***.***.***'s password:***
Last login: Sun Jul 13 13:18:49 2008 from ***
root@server [~]# cd /usr/local/src
root@server [/usr/local/src]# wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
--16:21:05-- http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
Resolving www.zdziarski.com... 209.51.159.242
Connecting to www.zdziarski.com|209.51.159.242|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 20454 (20K) [application/x-tar]
Saving to: `mod_evasive_1.10.1.tar.gz'
100%[=======================================>] 20,454 --.-K/s in 0.06s
16:21:06 (331 KB/s) - `mod_evasive_1.10.1.tar.gz' saved [20454/20454]
root@server [/usr/local/src]# tar -zxf mod_evasive_1.10.1.tar.gz
root@server [/usr/local/src]# cd mod_evasive
root@server [/usr/local/src/mod_evasive]# /usr/sbin/apxs -cia mod_evasive20.c
/usr/lib/apr-1/build/libtool --silent --mode=compile gcc -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -pthread -I/usr/include/httpd -I/usr/include/apr-1 -I/usr/include/apr-1 -c -o mod_evasive20.lo mod_evasive20.c && touch mod_evasive20.slo
mod_evasive20.c: In function 'access_checker':
mod_evasive20.c:212: warning: implicit declaration of function 'getpid'
mod_evasive20.c:212: warning: format '%ld' expects type 'long int', but argument 4 has type 'int'
mod_evasive20.c:229: warning: ignoring return value of 'system', declared with attribute warn_unused_result
mod_evasive20.c: In function 'destroy_hit_list':
mod_evasive20.c:301: warning: control reaches end of non-void function
mod_evasive20.c: In function 'create_hit_list':
mod_evasive20.c:118: warning: control reaches end of non-void function
/usr/lib/apr-1/build/libtool --silent --mode=link gcc -o mod_evasive20.la -rpath /usr/lib/httpd/modules -module -avoid-version mod_evasive20.lo
/usr/lib/httpd/build/instdso.sh SH_LIBTOOL='/usr/lib/apr-1/build/libtool' mod_evasive20.la /usr/lib/httpd/modules
/usr/lib/apr-1/build/libtool --mode=install cp mod_evasive20.la /usr/lib/httpd/modules/
cp .libs/mod_evasive20.so /usr/lib/httpd/modules/mod_evasive20.so
cp .libs/mod_evasive20.lai /usr/lib/httpd/modules/mod_evasive20.la
cp .libs/mod_evasive20.a /usr/lib/httpd/modules/mod_evasive20.a
chmod 644 /usr/lib/httpd/modules/mod_evasive20.a
ranlib /usr/lib/httpd/modules/mod_evasive20.a
PATH="$PATH:/sbin" ldconfig -n /usr/lib/httpd/modules
----------------------------------------------------------------------
Libraries have been installed in:
/usr/lib/httpd/modules
If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
- add LIBDIR to the `LD_LIBRARY_PATH' environment variable
during execution
- add LIBDIR to the `LD_RUN_PATH' environment variable
during linking
- use the `-Wl,--rpath -Wl,LIBDIR' linker flag
- have your system administrator add LIBDIR to `/etc/ld.so.conf'
See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
chmod 755 /usr/lib/httpd/modules/mod_evasive20.so
[activating module `evasive20' in /etc/httpd/conf/httpd.conf]
root@server [/usr/local/src/mod_evasive]# pico /etc/httpd/conf/httpd.conf
root@server [/usr/local/src/mod_evasive]# service httpd restart
اگر خواستيد که هر وقت يک ip بسته ميشه براي شما alert ميل کنه اين خط رو به تنظيمات فوق اضافه مي کنيد : DOSEmailNotify root که به جاي root مي تونيد ادرس ايميلتون رو وارد کنيد .
اگه از بچه ها به سوالی برخورد کرد با من تماس بگیره
اگر نسخه Apache 1.3.x داريد :
----command-----
cd /usr/local/src
wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/local/apache/bin/apxs -cia mod_evasive.c
-----command-----
اگر نسخه ي Apache 2.0.x داريد:
-----command-----
up2date -i httpd-devel
cd /usr/local/src
wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
tar -zxf mod_evasive_1.10.1.tar.gz
cd mod_evasive
/usr/sbin/apxs -cia mod_evasive20.c
-----command
حالا بايد اين ماژول رو در تنظميات apache تون اضافه کنيد و تنظيمات لازمش رو انجام بديد : (براي apache 1.3.x )
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 600
تنضيمات httpd.conf براي نسخه ي apache 2.0.x (توجه داشته باشيد نسخه رو درست انتخاب کنيد)
DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 10
DOSBlockingPeriod 600
اینم نمومه کپی یکی از دستورات SSH
login as: root
root@***.***.***.***'s password:***
Last login: Sun Jul 13 13:18:49 2008 from ***
root@server [~]# cd /usr/local/src
root@server [/usr/local/src]# wget http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
--16:21:05-- http://www.zdziarski.com/projects/mod_evasive/mod_evasive_1.10.1.tar.gz
Resolving www.zdziarski.com... 209.51.159.242
Connecting to www.zdziarski.com|209.51.159.242|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 20454 (20K) [application/x-tar]
Saving to: `mod_evasive_1.10.1.tar.gz'
100%[=======================================>] 20,454 --.-K/s in 0.06s
16:21:06 (331 KB/s) - `mod_evasive_1.10.1.tar.gz' saved [20454/20454]
root@server [/usr/local/src]# tar -zxf mod_evasive_1.10.1.tar.gz
root@server [/usr/local/src]# cd mod_evasive
root@server [/usr/local/src/mod_evasive]# /usr/sbin/apxs -cia mod_evasive20.c
/usr/lib/apr-1/build/libtool --silent --mode=compile gcc -prefer-pic -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -pthread -I/usr/include/httpd -I/usr/include/apr-1 -I/usr/include/apr-1 -c -o mod_evasive20.lo mod_evasive20.c && touch mod_evasive20.slo
mod_evasive20.c: In function 'access_checker':
mod_evasive20.c:212: warning: implicit declaration of function 'getpid'
mod_evasive20.c:212: warning: format '%ld' expects type 'long int', but argument 4 has type 'int'
mod_evasive20.c:229: warning: ignoring return value of 'system', declared with attribute warn_unused_result
mod_evasive20.c: In function 'destroy_hit_list':
mod_evasive20.c:301: warning: control reaches end of non-void function
mod_evasive20.c: In function 'create_hit_list':
mod_evasive20.c:118: warning: control reaches end of non-void function
/usr/lib/apr-1/build/libtool --silent --mode=link gcc -o mod_evasive20.la -rpath /usr/lib/httpd/modules -module -avoid-version mod_evasive20.lo
/usr/lib/httpd/build/instdso.sh SH_LIBTOOL='/usr/lib/apr-1/build/libtool' mod_evasive20.la /usr/lib/httpd/modules
/usr/lib/apr-1/build/libtool --mode=install cp mod_evasive20.la /usr/lib/httpd/modules/
cp .libs/mod_evasive20.so /usr/lib/httpd/modules/mod_evasive20.so
cp .libs/mod_evasive20.lai /usr/lib/httpd/modules/mod_evasive20.la
cp .libs/mod_evasive20.a /usr/lib/httpd/modules/mod_evasive20.a
chmod 644 /usr/lib/httpd/modules/mod_evasive20.a
ranlib /usr/lib/httpd/modules/mod_evasive20.a
PATH="$PATH:/sbin" ldconfig -n /usr/lib/httpd/modules
----------------------------------------------------------------------
Libraries have been installed in:
/usr/lib/httpd/modules
If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
- add LIBDIR to the `LD_LIBRARY_PATH' environment variable
during execution
- add LIBDIR to the `LD_RUN_PATH' environment variable
during linking
- use the `-Wl,--rpath -Wl,LIBDIR' linker flag
- have your system administrator add LIBDIR to `/etc/ld.so.conf'
See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
chmod 755 /usr/lib/httpd/modules/mod_evasive20.so
[activating module `evasive20' in /etc/httpd/conf/httpd.conf]
root@server [/usr/local/src/mod_evasive]# pico /etc/httpd/conf/httpd.conf
root@server [/usr/local/src/mod_evasive]# service httpd restart
اگر خواستيد که هر وقت يک ip بسته ميشه براي شما alert ميل کنه اين خط رو به تنظيمات فوق اضافه مي کنيد : DOSEmailNotify root که به جاي root مي تونيد ادرس ايميلتون رو وارد کنيد .
اگه از بچه ها به سوالی برخورد کرد با من تماس بگیره