mod_evasive

[Lucas]

Well, I have managed to successfully install mod_evasive, but I see IPs getting blocked without DDoS attack... The server is new, just a couple of clients being hosted and I haven't been DDoSed yet, thankfully. Shouldn't it only block if there is an attack? I guess I would have to play around with the settings and make them less sensitive?

I currently have:

<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify root
</IfModule>

Edit: I am now trying the following

<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify root
</IfModule>

 

[Lucas]

Nobody? This is quiet a nice application but it really needs careful configuration.

 

[Infopro]

Shouldn't it only block if there is an attack?

Not necessarily, if you use the wrong settings you might find just clicking around a site can block a user if they do it enough. You'll have to find a comfort zone that works for you.

Lots of old threads around on this topic, like this one.
http://forums.cpanel.net/showthread.php?p=306993&highlight=DOSBlockingPeriod#post306993