Mod evasive

Overview

Mod_evasive is the Denial of Service module used in [ASL]. It is designed to throttle connections when they reach above a specified threshold.

[file "mod_evasive20.c"] [line 246] [level 3] client denied by server configuration:

This message indicates the threshold has been exceeded. To increase the threshold perform the following:

Step 1) Edit /etc/asl/config

 vim /etc/asl/config

Step 2) Increase the thresholds in the following fields

 MODEV_DOSPageCount="5"
 MODEV_DOSSiteCount="200"
 MODEV_DOSPageInterval="2"
 MODEV_DOSSiteInterval="2"

NOTE: These vary depending on the environment, we start by doubling the values, and then backing them off.

Step 3) Update the security policy with:

 asl -s -f