Mod_dosevasive, ¿?¿?

[sh4ka]

I heard about Mod_dosevasive (http://www.nuclearelephant.com/projects/dosevasive/) .
Is it recommended for RHAS+cPanel servers ? Any suggestions about ? I already have APF+BFD+Mod_Security, should this be another good security tool ?

[richy]

It'll be good, but it breaks Frontpage extensions (i.e. if you upload via Frontpage, you'll get blocked).

[sh4ka]

yeap, I heard about it breaks front page extensions, but will it cause conflict with mod_security, bfd or apf firewall ? anyone with all this installed and running mod_dosevasive withouth problems ?

[demomen]

richy is that the only thing it breaks

upload via Frontpage, you'll get blocked)?

[chirpy]

That's the only thing that I've seen it break. On servers where visitors have particularly quick access it can end up treating them as DOS attackers and so sometimes tuning of the variables is required. It's not for every server usage demographic, but it can help for others.

[sh4ka]

My actual variables are defined as:

 
    DOSHashTableSize    3097
    DOSPageCount        5
    DOSSiteCount        100
    DOSPageInterval     2
    DOSSiteInterval     2
    DOSBlockingPeriod   600

Chirpy, what variables do you suggest to avoid problems with legitim users ? are this fine ?