Mod Evasive pour Apache, la fausse bonne idée

Bonjour à tous,

Dans la continuité de mon article sur la protection anti-ddos pour Nginx, j’étais parti pour vous écrire un article sur l’installation du module evasive pour Apache qui est censé faire la même chose.

Le problème, c’est que je ne vous expliquerais pas comment installer ce module, car au moment des tests, j’ai eu une grosse déception.

Voici mes tests, je précise que je les ai fait sur la page par défaut d’Apache …

Avant l’installation du module Evasive :

Log de test :

 root@debian:~# ab -n 20000 -c 300 http://192.168.1.13/
 This is ApacheBench, Version 2.3 <$Revision: 655654 $>
 Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
 Licensed to The Apache Software Foundation, http://www.apache.org/
    
 Benchmarking 192.168.1.13 (be patient)
 Completed 2000 requests
 Completed 4000 requests
 Completed 6000 requests
 Completed 8000 requests
 Completed 10000 requests
 Completed 12000 requests
 Completed 14000 requests
 Completed 16000 requests
 Completed 18000 requests
 Completed 20000 requests
 Finished 20000 requests
 Server Software: Apache/2.2.22
 Server Hostname: 192.168.1.13
 Server Port: 80
    
 Document Path: /
 Document Length: 177 bytes
    
 Concurrency Level: 300
 Time taken for tests: 11.703 seconds
 Complete requests: 20000
 Failed requests: 0
 Write errors: 0
 Total transferred: 9060000 bytes
 HTML transferred: 3540000 bytes
 Requests per second: 1708.97 [#/sec] (mean)
 Time per request: 175.544 [ms] (mean)
 Time per request: 0.585 [ms] (mean, across all concurrent requests)
 Transfer rate: 756.02 [Kbytes/sec] received
    
 Connection Times (ms)
 min mean[+/-sd] median max
 Connect: 0 74 89.7 78 3086
 Processing: 30 100 145.1 82 2026
 Waiting: 23 100 145.0 81 2025
 Total: 77 174 165.8 160 3166
    
 Percentage of the requests served within a certain time (ms)
 50% 160
 66% 162
 75% 164
 80% 165
 90% 168
 95% 173
 98% 346
 99% 804
 100% 3166 (longest request)

HTOP pris au moment du test :

Après l’installation du module Evasive :

Log de test :

root@debian:~# ab -n 20000 -c 300 http://192.168.1.13/
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
 
Benchmarking 192.168.1.13 (be patient)
Completed 2000 requests
Completed 4000 requests
Completed 6000 requests
Completed 8000 requests
Completed 10000 requests
Completed 12000 requests
Completed 14000 requests
Completed 16000 requests
Completed 18000 requests
Completed 20000 requests
Finished 20000 requests
Server Software: Apache/2.2.22
Server Hostname: 192.168.1.13
Server Port: 80
 
Document Path: /
Document Length: 280 bytes
 
Concurrency Level: 300
Time taken for tests: 9.744 seconds
Complete requests: 20000
Failed requests: 9
(Connect: 0, Receive: 0, Length: 9, Exceptions: 0)
Write errors: 0
Non-2xx responses: 19991
Total transferred: 9659730 bytes
HTML transferred: 5599073 bytes
Requests per second: 2052.54 [#/sec] (mean)
Time per request: 146.161 [ms] (mean)
Time per request: 0.487 [ms] (mean, across all concurrent requests)
Transfer rate: 968.11 [Kbytes/sec] received
 
Connection Times (ms)
min mean[+/-sd] median max
Connect: 8 68 34.3 71 1053
Processing: 32 77 31.3 73 900
Waiting: 30 76 31.2 73 900
Total: 41 145 44.8 143 1131
 
Percentage of the requests served within a certain time (ms)
50% 143
66% 146
75% 148
80% 150
90% 157
95% 162
98% 171
99% 178
100% 1131 (longest request)
 

HTOP pris au moment du test :

Fichier de configuration du module evasive :

 DOSHashTableSize 3097
 DOSPageCount 2
 DOSPageInterval 1
 DOSSiteCount 100
 DOSSiteInterval 1
 DOSBlockingPeriod 300
 DOSLogDir "/var/lock/mod_evasive"

Conclusion :

Vous voyez la différence ? Moi non plus, et le problème est bien là. Le module evasive demande autant de puissance pour traiter les requêtes que lorsque le serveur subit simplement l’attaque DDOS sans essayer de se défendre …

En bref, utilisez un Reverse Proxy Nginx pour vous défendre contre ce type d’attaque, le module evasive pour Apache est inefficace …