---
name: ap22-mod_evasive
version: 1.10.1_1
origin: www/mod_evasive
comment: An Apache module to try to protect the HTTP Server from DoS/DDoS attacks
arch: freebsd:9:x86:64
www: http://www.zdziarski.com/blog/?page_id=442
maintainer: kiwi@oav.net
prefix: /usr/local
licenselogic: single
flatsize: 52988
desc: "mod_dosevasive is an evasive maneuvers module for Apache to provide evasive
  \naction in the event of an HTTP DoS or DDoS attack or brute force attack.\nIt is
  also designed to be a detection and network management tool, and can be\neasily
  configured to talk to ipchains, firewalls, routers, and etcetera.\nmod_dosevasive
  presently reports abuses via email and syslog facilities.\n\nDetection is performed
  by creating an internal dynamic hash table of IP\nAddresses and URIs, and denying
  any single IP address from any of the\nfollowing:\n\n    * Requesting the same page
  more than a few times per second\n    * Making more than 50 concurrent requests
  on the same child per second\n    * Making any requests while temporarily blacklisted
  (on a blocking list) \n\nThis method has worked well in both single-server script
  attacks as well as\ndistributed attacks, but just like other evasive tools, is only
  as useful to\nthe point of bandwidth and processor consumption (e.g. the amount
  of bandwidth\nand processor required to receive/process/respond to invalid requests),
  which\nis why it's a good idea to integrate this with your firewalls and routers
  for\nmaximum protection.\n\nThis module instantiates for each listener individually,
  and therefore has a\nbuilt-in cleanup mechanism and scaling capabilities. Because
  of this per-child\ndesign, legitimate requests are never compromised (even from
  proxies and NAT\naddresses) but only scripted attacks. Even a user repeatedly clicking
  on\n'reload' should not be affected unless they do it maliciously. mod_dosevasive\nis
  fully tweakable through the Apache configuration file, easy to incorporate\ninto
  your web server, and easy to use. \n\nWWW: http://www.zdziarski.com/blog/?page_id=442\n"
deps:
  apache22: {origin: www/apache22, version: 2.2.25}
  expat: {origin: textproc/expat2, version: 2.1.0}
  perl: {origin: lang/perl5.14, version: 5.14.4}
  pcre: {origin: devel/pcre, version: 8.33}
  gettext: {origin: devel/gettext, version: 0.18.3}
  apr: {origin: devel/apr1, version: 1.4.8.1.5.2}
  gdbm: {origin: databases/gdbm, version: 1.10}
  db42: {origin: databases/db42, version: 4.2.52_5}
  libiconv: {origin: converters/libiconv, version: 1.14_1}
categories:
- www
- security
shlibs_provided:
- mod_evasive20.so
files:
  /usr/local/libexec/apache22/mod_evasive20.so: aa6ea15ce62a2e68b3f3575710bc4eb8c28b3bf3685831323f7136ddc0152388
  /usr/local/share/doc/mod_evasive/LICENSE: 511f371b94b82cb2baf1b62eaf7027eb40c3932d8033eb0c5060db32f64d0b13
  /usr/local/share/doc/mod_evasive/README: 81b25c868c71f8071785911e0b00f6d6a578d96532240269c0571a88c9511ed4
  /usr/local/share/doc/mod_evasive/test.pl: 131ec7214bc5cd39023247e37cd3ad93cc94b4a0a85197b71ed003a13727f31a
directories:
  /usr/local/share/doc/mod_evasive/: n
scripts:
  post-install: |
    /usr/local/sbin/apxs -e -A -n evasive20 /usr/local/libexec/apache22/mod_evasive20.so
  pre-deinstall: |
    /usr/bin/sed -i '' -E '/LoadModule[[:blank:]]+evasive20_module/d' /usr/local/etc/apache22/httpd.conf
    echo "Don't forget to remove all mod_evasive20-related directives in your httpd.conf"
