CentOS8でサーバー構築 - 10.ApacheのDoS攻撃対策(mod_evasive)

mod_evasiveのインストール

2020/07/15現在、オフィシャルの CentOS8用のリポジトリに rpmは存在しないので、
同じカーネルの Fedora29のアーカイブページの rpmからネットワーク経由でインストールする。
Linuxカーネルを確認
# rpm -q kernel
kernel-4.18.0-147.3.1.el8_1.x86_64
kernel-4.18.0-147.8.1.el8_1.x86_64
kernel-4.18.0-193.6.3.el8_2.x86_64
  4.18なので、Fedora29(kernel4.18)のrpmでインストールする。
インストール
# rpm -ivh https://archives.fedoraproject.org/pub/archive/fedora/linux/updates/29/Everything/x86_64/Packages/m/mod_evasive-1.10.1-31.fc29.x86_64.rpm
インストール確認
# httpd -M | grep evasive
 evasive20_module (shared)

mod_evasiveの設定

mod_evasive.conf設定
# vi /etc/httpd/conf.d/mod_evasive.conf
# mod_evasive configuration
LoadModule evasive20_module modules/mod_evasive24.so

<IfModule mod_evasive24.c>
    # The hash table size defines the number of top-level nodes for each
    # child's hash table.  Increasing this number will provide faster
    # performance by decreasing the number of iterations required to get to the
    # record, but consume more memory for table space.  You should increase
    # this if you have a busy web server.  The value you specify will
    # automatically be tiered up to the next prime number in the primes list
    # (see mod_evasive.c for a list of primes used).
     DOSHashTableSize    3097

    # This is the threshhold for the number of requests for the same page (or
    # URI) per page interval.  Once the threshhold for that interval has been
    # exceeded, the IP address of the client will be added to the blocking
    # list.
     DOSPageCount        10

    # This is the threshhold for the total number of requests for any object by
    # the same client on the same listener per site interval.  Once the
    # threshhold for that interval has been exceeded, the IP address of the
    # client will be added to the blocking list.
     DOSSiteCount        5

    # The interval for the page count threshhold; defaults to 1 second
    # intervals.
     DOSPageInterval     2

    # The interval for the site count threshhold; defaults to 1 second
    # intervals.
     DOSSiteInterval     1

    # The blocking period is the amount of time (in seconds) that a client will
    # be blocked for if they are added to the blocking list.  During this time,
    # all subsequent requests from the client will result in a 403 (Forbidden)
    # and the timer being reset (e.g. another 10 seconds).  Since the timer is
    # reset for every subsequent request, it is not necessary to have a long
    # blocking period; in the event of a DoS attack, this timer will keep
    # getting reset.
     DOSBlockingPeriod   60

    # If this value is set, an email will be sent to the address specified
    # whenever an IP address becomes blacklisted.  A locking mechanism using
    # /tmp prevents continuous emails from being sent.
    #
    # NOTE: Requires /bin/mail (provided by mailx)
     DOSEmailNotify      "-s '[mod_evasive] Alert' メールアドレス"

    # If this value is set, the system command specified will be executed
    # whenever an IP address becomes blacklisted.  This is designed to enable
    # system calls to ip filter or other tools.  A locking mechanism using /tmp
    # prevents continuous system calls.  Use %s to denote the IP address of the
    # blacklisted IP.
    #DOSSystemCommand    "su - someuser -c '/sbin/... %s ...'"

    # Choose an alternative temp directory By default "/tmp" will be used for
    # locking mechanism, which opens some security issues if your system is
    # open to shell users.
    #
    #
    #   http://security.lss.hr/index.php?page=details&ID=LSS-2005-01-01
    #
    # In the event you have nonprivileged shell users, you'll want to create a
    # directory writable only to the user Apache is running as (usually root),
    # then set this in your httpd.conf.
    DOSLogDir           "/var/lock/mod_evasive"

    # You can use whitelists to disable the module for certain ranges of
    # IPs. Wildcards can be used on up to the last 3 octets if necessary.
    # Multiple DOSWhitelist commands may be used in the configuration.
    #DOSWhitelist   127.0.0.1
    #DOSWhitelist   192.168.0.*
</IfModule>
同じページに DOSPageInterval 秒に DOSPageCount 回のアクセスがあったらブラックリストへ。
同じサイトに DOSSiteInterval 秒に DOSSiteCount 回のアクセスがあったらブラックリストへ。
ブラックリストに登録された IPからは DOSBlockingPeriod 秒間 403を返す。
ロックファイル格納ディレクトリ作成
# mkdir /var/lock/mod_evasive
# chmod 777 /var/lock/mod_evasive
Apache再起動
# httpd -t
Syntax OK
# systemctl restart httpd

テストプログラムの実行

そのままでは BadRequest 400 が返ってくるので、test.plを修正。
私はPHPよりPerl歴の方が長いです・
test.pl修正
# vi /usr/share/doc/mod_evasive/test.pl
  print $SOCKET "GET /?$_ HTTP/1.0\r\n\r\n";
テスト実行
# perl /usr/share/doc/mod_evasive/test.pl
?
?
  Apacheの設定や環境によってはうまくいかないかもしれません。
  そんな時はブラウザでF5連打で試しましょう。
  成功すると、設定したアドレス宛に
To: -s '[mod_evasive] Alert' メールアドレス
Subject: HTTP BLACKLIST xxx.xxx.xxx.xxx

mod_evasive HTTP Blacklisted xxx.xxx.xxx.xxx

  とメールが届きます。