> ## Content Index
> Fetch the complete content index at: https://snubmonkey.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Secure Apache Web Server with ModEvasive on Ubuntu Server.
- URL: https://snubmonkey.com/how-to-secure-apache-web-server-with-modevasive-on-ubuntu-server/
- Published: 2021-05-17T09:58:00.000Z
- Updated: 2025-04-16T22:48:39.000Z
- Description: Apache HTTP Server is a free and open-source web server that delivers web content through the internet. Apache is just one component that is needed in a web application stack to deliver web content. One of the most common web application stacks involves LAMP, or Linux, Apache, MySQL, and PHP.
- Author: yannick Coffi
- Tags: how to 🪄, linux 🐧, security 🦾🦿

According to a July 2021 research published by w3techs, Apache has a market share of around **33.7 %**. That being said, the Apache webserver is very well targeted by most hackers. The software is secure out-of-the-box but you can still harden it with some additional modules.

One of the most common methods of securing your Apache web server is installing ModEvasive. This is a highly smart Apache module that provides evasive actions against Distributed Denial of Service and Brute Force attacks.

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. During the DDoS session, regular users cannot access your website or web application and this can mean loss of sales or even lead to a complete shutdown of your business.

A brute-force attack, on the other hand, is an automated break-in method that tries to gain access to resources on your web server. The attack uses millions of usernames and passwords in order to guess the login credentials of a secured web resource to obtain classified information.

In this tutorial, we will show you how to safeguard your Apache webserver against both DDoS and brute-force attacks.  

##   
Step 1: Installing ModEvasive  
  
Run the command below to install ModEvasive:

```zsh
$ sudo apt-get install libapache2-modevasive

```

##   
Step 2: Checking the Status of ModEvasive  
  
Check the status of ModEvasive by running the following command:

```zsh
$ sudo apachectl -M | grep evasive

```

You should see the below output if the module is enabled on the server:

```zsh
evasive20_module (shared)

```

##   
Step 3: Configuring ModEvasive

  
In a Linux system, configuration files are mostly found in the `/etc` directory. Its configuration file is located at `/etc/apache2/mods-enabled/evasive.conf`.

 We need to make a few changes:

```zsh
$ sudo nano /etc/apache2/mods-enabled/evasive.conf

```

  
By default, the entries of this file are commented with a pound sign. We need to uncomment all those lines by removing the '**#**' sign. Then, enter the email address where you want to receive emails when ModEvasive intercepts an attack targeted to your web server.

You will enter the email address next to DOSEmailNotify (ie. monkey@example.com) directive:

In the end, it should look like the one below:

```zsh
<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        2
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
    DOSEmailNotify      monkey@example.com
    #DOSSystemCommand    "su - someuser -c '/sbin/... %s ...'"
    DOSLogDir           "/var/log/mod_evasive"
</IfModule>
```

Let's go over each of the above entries one by one in order to understand how ModEvasive settings work:

**DOSHashTableSize**  
  
The value here specifies the size of the table that tracks the activities of users based on their past IP address visits. The default value will work well for most websites.

You should only increase this value to speed up lookups only if your website is busy because a large value can have an adverse effect on your server's memory.

**DOSPageCount**

This directive specifies genuine requests that a visitor can make to a specific resource in a given amount of time that is specified by the **DOSPageInterval** directive before triggering ModEvasive. If the threshold is exceeded, the visitor's IP address is blocked and added to a blacklist.

**DOSSiteCount**

This directive is similar to DOSPageCount but specifies the number of legitimate requests that can be made to an entire website over the period of time specified by the **DOSSiteInterval** directive.

**DOSPageInterval**

As indicated above, this value works hand in hand with **DOSPageCount**. The default value is 1 second and this means that the page count threshold specified with the **DOSPageCount** should not be exceeded within 1 second or as specified otherwise this will cause the IP address of the client to be blacklisted.

**DOSSiteInterval**

This interval works together with **DOSSiteCount**. It defaults to 1 second and if the **DOSSiteCount** threshold is reached within this time, ModEvasive will trigger an IP block.

**DOSBlockingPeriod**

This value represents the amount of time in seconds that a client remains blocked after being added to the blacklist.

The default value is 10 seconds. During this time, the client will get a forbidden error message when trying to access any resource on the server.

**DOSEmailNotify**

You can specify an address that will receive a message every time an IP address is blocked.

**DOSSystemCommand**

Apart from sending an email, you can invoke a system command every time an IP address gets blocked. The **%s** variable contains the IP address that is blocked during the interception.

For instance, you can run a command to add a firewall rule that blocks a specific IP address to avoid further attacks on your web server.

**DOSLogDir**

This directory logs any interceptions made by ModEvasive. You can use a different directory depending on your needs.

## Step 4: Creating ModEvasive Log Directory

  
By default, the log directory specified on the configuration file is not created when ModEvasive is installed. We need to create this folder using the `mkdir` command:

```zsh
$ sudo mkdir /var/log/mod_evasive 

```

Since Apache runs under the **www-data** user, we should give full ownership of the directory to the web server using the **chown** command:

```zsh
$ sudo chown -R www-data:www-data /var/log/mod_evasive

```

You can now restart Apache for the changes to take effect.

```zsh
$ sudo systemctl restart apache2
```

You may run the below command to see if ModEvasive was able to record the intrusion on the log directory:

```zsh
$ sudo ls -a /var/log/mod_evasive

```

You should see the output below:

```zsh
 .  ..  dos-127.0.0.1

```

Also, you can check the content of the Apache error log file to confirm the same:

```
$ sudo tail /var/log/apache2/error.log
```

You will get the output as shown below:

```
...
...[evasive20:error] [pid 141980:tid 281472644649360] [client 127.0.0.1:41934] client denied by server configuration: /var/www/...
...

```

This will keep your website safe and ensure that your web server is not compromised by malicious hackers who might want to block access or steal information from your website or applications.

 Cheers:\~)