You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Matthew Jones <m....@hud.ac.uk> on 2016/10/31 15:20:59 UTC

[users@httpd] Whitelisting in mod_evasive

Hello all, first up apologies if this is not the correct place for this question. If it's not, then I'd appreciate a nudge in the correct direction.

I'm trying to configure mod_evasive so that it whitelists a number of IP ranges, in particular our private 10.*.*.* network. I've added that range to the DOSWhitelist but we're still seeing blacklisting of 10.*.*.* addresses reported by mod_evasive via email.

Here is the content of evasive.conf:

<IfModule mod_evasive20.c>
        DOSHashTableSize        6400
        DOSPageCount            2
        DOSSiteCount            64
        DOSPageInterval         1
        DOSSiteInterval         1
        DOSBlockingPeriod       60
        DOSEmailNotify          cs-unixsupportteam@hud.ac.uk
        DOSWhitelist            10.*.*.* 172.22.*.* 161.112.232.102 161.112.232.103 161.112.232.111 161.112.232.117 161.112.232.221 161.112.232.37
</IfModule>

We're using apache 2.4.7 on Ubuntu 14.04.05. Please let me know if there is any further information which might be of help in diagnosing this.

I know that mod_evasive is active as I say because it's reporting the blacklisting of those 10.* IPs, so what am I missing about how to configure it to whitelist these IP ranges please?

Thanks in advance for your valuable time.

Matt Jones

University of Huddersfield inspiring tomorrow's professionals.
[http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg]

This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

Re: [users@httpd] Whitelisting in mod_evasive

Posted by Matthew Jones <m....@hud.ac.uk>.
On 02/11/2016, 08:42, "Luca Toscano" <to...@gmail.com>> wrote:

as side note mod_evasive is a third party module not included in the httpd official release, so we can try to help but it would be better to follow up with the module's author (even though if I remember correctly the project is not active at the moment).

OK, many thanks for helping nonetheless

Does the module correctly whitelist the other IPs? Can you try something like:

DOSWhitelist 10.*.*.*
DOSWhitelist 172.22.*.*
...
...

OK, so far that seems to be working: not seeing IPs in either of the above ranges being blacklisted. Many thanks!

—
Matt Jones

University of Huddersfield inspiring tomorrow's professionals.
[http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg]

This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

Re: [users@httpd] Whitelisting in mod_evasive

Posted by Luca Toscano <to...@gmail.com>.
Hi Matthew,

2016-10-31 16:20 GMT+01:00 Matthew Jones <m....@hud.ac.uk>:

> Hello all, first up apologies if this is not the correct place for this
> question. If it’s not, then I’d appreciate a nudge in the correct direction.
>
>
>
> I’m trying to configure mod_evasive so that it whitelists a number of IP
> ranges, in particular our private 10.*.*.* network. I’ve added that range
> to the DOSWhitelist but we’re still seeing blacklisting of 10.*.*.*
> addresses reported by mod_evasive via email.
>

as side note mod_evasive is a third party module not included in the httpd
official release, so we can try to help but it would be better to follow up
with the module's author (even though if I remember correctly the project
is not active at the moment).


>
>
> Here is the content of evasive.conf:
>
>
>
> <IfModule mod_evasive20.c>
>
>         DOSHashTableSize        6400
>
>         DOSPageCount            2
>
>         DOSSiteCount            64
>
>         DOSPageInterval         1
>
>         DOSSiteInterval         1
>
>         DOSBlockingPeriod       60
>
>         DOSEmailNotify          cs-unixsupportteam@hud.ac.uk
>
>         DOSWhitelist            10.*.*.* 172.22.*.* 161.112.232.102
> 161.112.232.103 161.112.232.111 161.112.232.117 161.112.232.221
> 161.112.232.37
>
> </IfModule>
>
>
>
> We’re using apache 2.4.7 on Ubuntu 14.04.05. Please let me know if there
> is any further information which might be of help in diagnosing this.
>
>
>
> I know that mod_evasive is active as I say because it’s reporting the
> blacklisting of those 10.* IPs, so what am I missing about how to configure
> it to whitelist these IP ranges please?
>

Does the module correctly whitelist the other IPs? Can you try something
like:

DOSWhitelist 10.*.*.*
DOSWhitelist 172.22.*.*
...
...

Let me know if anything changes!

Luca