54 lines
2.1 KiB
Bash
54 lines
2.1 KiB
Bash
#!/bin/bash
|
|
# Make sure script is ran as root
|
|
if [[ $EUID -ne 0 ]]; then
|
|
exec sudo /bin/bash "$0" "$@"
|
|
fi
|
|
|
|
# https://bobcares.com/blog/apache-prevent-ddos/
|
|
|
|
if ! dpkg -l | grep -q "debconf-doc"; then
|
|
# https://askubuntu.com/questions/556385/how-can-i-install-apt-packages-non-interactively
|
|
echo "Installed debconf-doc..."
|
|
apt install debconf-doc -y
|
|
fi
|
|
|
|
if ! dpkg -l | grep -q "libapache2-mod-evasive"; then
|
|
echo "Installed libapache2-mod-evasive..."
|
|
DEBIAN_FRONTEND=noninteractive apt install libapache2-mod-evasive -y
|
|
fi
|
|
|
|
if grep -q "#DOSHashTableSize" "/etc/apache2/mods-enabled/evasive.conf" || [[ ! -f "/etc/apache2/mods-enabled/evasive.conf" ]] || [[ $1 = "updateconf" ]]; then
|
|
# https://phoenixnap.com/kb/apache-mod-evasive
|
|
echo "Adding libapache2-mod-evasive config..."
|
|
cat <<EOT > "/etc/apache2/mods-enabled/evasive.conf"
|
|
<IfModule mod_evasive20.c>
|
|
#DOSHashTableSize Default: 3097 Allocated memory for running the lookup operations. Increasing the size improves the speed at the cost of memory.
|
|
DOSHashTableSize 3097
|
|
|
|
#DOSPageCount Default: 2 The number of requests for an individual page that triggers blacklisting. Increasing value will reduce false-positives.
|
|
DOSPageCount 5
|
|
|
|
#DOSSiteCount Default: 50 The total number of requests for the same site by the same IP address. Increasing value will reduce false-positives.
|
|
DOSSiteCount 100
|
|
|
|
#DOSPageInterval Default: 1 Number of seconds during which DOSPageCount number of requests will trigger blacklisting.
|
|
DOSPageInterval 1
|
|
|
|
#DOSSiteInterval Default: 1 Number of seconds during which DOSSiteCount number of requests will trigger blacklisting.
|
|
DOSSiteInterval 1
|
|
|
|
#DOSBlockingPeriod Default: 10 Number of seconds an IP address stays on the blacklist.
|
|
DOSBlockingPeriod 10
|
|
|
|
#DOSEmailNotify you@yourdomain.com
|
|
#DOSSystemCommand "su - someuser -c '/sbin/... %s ...'"
|
|
#DOSLogDir "/var/log/mod_evasive"
|
|
#DOSWhitelist 192.168.0.13
|
|
#DOSWhitelist 192.168.0.*
|
|
</IfModule>
|
|
EOT
|
|
fi
|
|
|
|
systemctl reload apache2
|
|
|
|
echo 'Installation complete' |