Protect Apache Against Brute Force or DDoS Attacks Using Mod_Security and Mod_evasive Modules

Page 1 of 4123...Last »

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Use our Linode referral link if you plan to buy VPS (it starts at only $10/month).
  4. Support us via PayPal donate - Make a Donation
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

Gabriel Cánepa

Gabriel Cánepa is a GNU/Linux sysadmin and web developer from Villa Mercedes, San Luis, Argentina. He works for a worldwide leading consumer product company and takes great pleasure in using FOSS tools to increase productivity in all areas of his daily work.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

124 Responses

  1. Nguyen Hung says:

    Please help me. I was setup mod_security and mod_evasive. I used WordPress, its working good, but when I login, I type account and password. It notify is “You don’t have permission to access /wp-login.php on this server.”.

    • Ravi Saive says:

      @Nguyen,

      Try to add these following lines to .htaccess file and see..

      <IfModule mod_security.c>
      SecFilterEngine Off
      SecFilterScanPOST Off
      </IfModule>
  2. Ehphan says:

    Hi, thanks for the article it was great, only I faced a problem with google recaptcha values that contains suspicious values, I had to override a rule with
    SecRuleUpdateTargetById 981319 !ARGS:’g-recaptcha-response’
    but when I add it to tecmint.conf file httpd wont restart…. is there somewhere else that I have to add this custom rule?

    • Gabriel A. Cánepa says:

      @Ehphan,
      What errors are you getting while trying to restart Apache? What distribution / version are you using? Assuming CentOS 7, what is the output of systemctl -l status httpd and journalctl -xe immediately after failing to restart httpd?

  3. tashfeen says:

    is it possible to use firewalld instead of iptables as on my server i am using firewalld.

    • Gabriel A. Cánepa says:

      @tashfeen,
      It’s perfectly possible, but you will have to dig around a little. We may consider this as a topic for a future article.

  4. Tom Sweeney says:

    Nathan,
    I also had an issue with “modsecurity_crs_41_sql_injection_attacks.conf” when using WordPress. My issue was that the wp-admin panel would fail to load. I checked my error log and my issue was due to line 159. It has something to do with the number of special characters in a single parameter. In my case, changing the number at the end of the regex from “{5,}” to “{6,}” fixed the issue for me.

  5. Nathan Parks says:

    Extra note: I also had to disable “modsecurity_crs_20_protocol_violations.conf”. With it enabled non of the streaming audio on sites work under WordPress.

  6. Nathan Parks says:

    Thanks for the great writeup! This helped drastically with constant brute force attacks. I however had to disable “modsecurity_crs_41_sql_injection_attacks.conf”. When it was enabled it always took me to the welcome page when trying to access any of the WordPress pages on my server. This might be what Christian was running into a few months ago. I’m thinking it’s just an incompatibility between the two but I’m subscribing in case anyone smarter than me takes a look at it. Either way with all other modules enabled I’m far better off than before.

  1. May 20, 2016

    […] 114 […]

  2. November 8, 2016

    […] Nmap has the ability to do a much more aggressive scan that will often yield much of the same information but in one command instead of several. Let’s take a look at the output of an aggressive scan (Do note – an aggressive scan can set off intrusion detection/prevention systems!). […]

  3. November 9, 2016

    […] Nmap has the ability to do a much more aggressive scan that will often yield much of the same information but in one command instead of several. Let’s take a look at the output of an aggressive scan (Do note – an aggressive scan can set off intrusion detection/prevention systems!). […]

  4. November 15, 2016

    […] mod_security – which offers you to protect Apache against Brute Force or DDoS attacks. […]

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

Join Over 300K+ Linux Users
  1. 177,942
  2. 8,310
  3. 37,548

Are you subscribed?