Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Message-ID: <4991DAD8.5010606@post.io>
Date: Tue, 10 Feb 2009 21:51:52 +0200
From: Ivo Kostikov <ivo@post.io>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.9.1b1pre) Gecko/20081006 Shredder/3.0a3
MIME-Version: 1.0
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [users@httpd] problem with mod_evasive

Hey.

I have a problem with apache 2.2.9 on gentoo system.
mod_evasive just does not work.

grep -v "#" /etc/conf.d/apache2
APACHE2_OPTS="-D DEFAULT_VHOST -D LANGUAGE -D PHP5 -D EVASIVE -D CHROOT"
PIDFILE=/var/run/apache2.pid

Apache is using mpm-itk and mod_chroot.
Apache version is 2.2.9-r1

Chroot and ITK is working ok. But not mod_evasive.
No errors on startup. I see mod_evasive on loaded modules.
But test.pl gives HTTP/1.1 200 OK all time.

test.pl (not included with mod_evasive gentoo package)

#!/usr/bin/perl

# test.pl: small script to test mod_dosevasive's effectiveness

use IO::Socket;
use strict;

for(0..100) {
   my($response);
   my($SOCKET) = new IO::Socket::INET( Proto   => "tcp",
                                       PeerAddr=> "127.0.0.1:80");
   if (! defined $SOCKET) { die $!; }
   print $SOCKET "GET /?$_ HTTP/1.0\n\n";
   $response = <$SOCKET>;
   print $response;
   close($SOCKET);
}

mod_evasive configuration:

grep -v "#" /etc/apache2/modules.d/10_mod_evasive.conf
<IfDefine EVASIVE>
LoadModule evasive_module modules/mod_evasive.so

DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 100
DOSPageInterval 2
DOSSiteInterval 2
DOSBlockingPeriod 10

DOSEmailNotify xxxx@xxx.xx


DOSLogDir /var/log/apache2/evasive

</IfDefine>

I tested it with apache not in chroot - same result.
Also i tested mod_evasive from gentoo package and mod_evasive latest
version from
http://www.zdziarski.com/projects/mod_evasive/
Result is same, it just does not work.

Could this be a result of using mpm-itk?

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org