8 Easy Steps to Safeguard an Apache Web Server and Prevent DDoS Attacks

Distributed Denial of Service (DDoS) attacks have become an increasingly significant threat to web servers worldwide. As online business continues to grow, safeguarding your server from these attacks is essential to maintaining uptime, data integrity, and your online reputation. Apache, a popular web server software, is not immune to DDoS attacks and requires proper protection measures.

DDoS attacks on Apache web servers can take several forms, including HTTP flooding, SYN flood, and UDP flood. These attacks can lead to server downtime, data loss, and lasting damage to your organization’s reputation.

In this article, we will explain the 8 easiest ways to prevent DDoS attacks on Apache servers.

How to Prevent DDoS Attacks in Apache

Implementing a comprehensive strategy to prevent DDoS attacks on your Apache web server is vital to ensuring its stability, security, and overall performance.

Employing a combination of the below-mentioned methods, you can significantly reduce the risk of falling victim to a DDoS attack. Each of them targets different aspects of the attack vector, addressing specific vulnerabilities in the Apache server.

By understanding and applying these techniques, you can build a robust defense against DDoS attacks, safeguarding your web server and ensuring uninterrupted service for your users.

1. Tweak Apache Configuration

Adjusting various parameters within the Apache configuration can help minimize the impact of DDoS attacks on your web server. By fine-tuning these settings, you can optimize resource usage and improve your server’s ability to handle high volumes of incoming requests.

Here are some key Apache configuration parameters to tweak for DDoS resistance:

1. RequestReadTimeout: This parameter controls the amount of time the server waits for a client to send a request header and body. By reducing the RequestReadTimeout values, you can limit the time a potential attacker has to send slow requests and consume server resources.

RequestReadTimeout header=10-20,MinRate=500 body=10-20,MinRate=500


2. KeepAliveTimeout: The KeepAliveTimeout setting determines the amount of time the server waits for subsequent requests on a persistent connection. Decreasing this value can help free up resources more quickly by closing idle connections.

KeepAliveTimeout 5


3. MaxRequestWorkers: This parameter sets the maximum number of simultaneous connections your server can handle. To prevent resource exhaustion during a DDoS attack, you should configure MaxRequestWorkers based on your server’s available resources (memory and CPU). For example:

MaxRequestWorkers 150


4. MaxConnectionsPerChild: This setting limits the number of connections each child process can handle before being terminated. Adjusting this value can help prevent memory leaks and ensure that your server continues to run efficiently.

MaxConnectionsPerChild 1000


5. TimeOut: The TimeOut directive sets the amount of time the server waits for certain events, such as receiving a request, sending a response, or waiting for a CGI script to execute. Decreasing this value can help mitigate slowloris attacks by reducing the time an attacker can keep a connection open.

TimeOut 30


6. LimitRequestBody: You can limit the size of the request body to prevent attackers from sending large amounts of data and exhausting server resources. This setting can be applied to specific directories or globally.

LimitRequestBody 1048576


Once you’ve made the necessary adjustments to your Apache configuration, be sure to restart the server for the changes to take effect. By fine-tuning these parameters, you can improve your server’s ability to withstand DDoS attacks, ensuring that your website remains accessible and responsive even during periods of high traffic.

2. Install mod_evasive Apache Module

Mod_evasive is an Apache module designed to protect your web server against DDoS attacks, particularly HTTP flooding. By monitoring the IP addresses and the number of page requests made to your web server, mod_evasive can quickly identify and block suspicious traffic exceeding specified thresholds. This module is especially effective in detecting and preventing rapid, repeated requests from a single IP address or a group of IPs targeting the same page.

To install mod_evasive on an Apache server, follow these steps:

1. Install the mod_evasive package using the appropriate package manager for your system. For example, on Ubuntu, you can use the following command:

sudo apt-get install libapache2-mod-evasive


2. Once installed, create a configuration file for mod_evasive. On Ubuntu, you can create a file named evasive.conf in the /etc/apache2/mods-available directory:

sudo nano /etc/apache2/mods-available/evasive.conf


3. Add the following example configuration to the file:

DOSHashTableSize 3097
DOSPageCount 5
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSEmailNotify youremail@example.com
DOSLogDir "/var/log/apache2/evasive"


Adjust the configuration parameters as needed. Here is a brief overview of key mod_evasive parameters:

4. Save the configuration file and enable the mod_evasive module:

sudo a2enmod evasive


5. Restart the Apache web server to apply the changes:

sudo systemctl restart apache2


By properly configuring and installing mod_evasive on your Apache web server, you can effectively mitigate HTTP flooding and other similar DDoS attacks. Always monitor and fine-tune the module’s parameters to maintain the balance between security and user experience.

3. Install mod_security Module

Mod_security is an open-source, powerful Apache module that acts as a web application firewall (WAF). It protects your web server by monitoring HTTP traffic in real-time and filtering or blocking requests that match known attack patterns or display suspicious behavior. Mod_security is highly configurable, allowing you to create custom rules tailored to your specific needs and threat landscape.

For example, if you notice a pattern of SQL injection attempts targeting your server, you can create a mod_security rule to block requests containing specific SQL keywords, reducing the likelihood of a successful attack. Additionally, mod_security can help prevent cross-site scripting (XSS) attacks by blocking requests containing potentially malicious scripts.

Key mod_security parameters include:

To install and enable mod_security on your Apache server, follow these steps:

1. Install the required packages: On Debian-based systems, run sudo apt-get install libapache2-mod-security2. On Red Hat-based systems, run sudo yum install mod_security.
2. Enable mod_security: On Debian-based systems, run sudo a2enmod security2. On Red Hat-based systems, add the following line to your Apache configuration file: LoadModule security2_module modules/mod_security2.so.
3. Configure mod_security: Create a new configuration file (e.g., /etc/apache2/mods-available/security2.conf on Debian-based systems) and add your desired mod_security rules and settings.
4. Restart Apache: Run sudo service apache2 restart (Debian-based systems) or sudo service httpd restart (Red Hat-based systems) to apply the changes.

By installing and properly configuring the mod_security module, you can significantly enhance your Apache web server’s security and resilience against various types of attacks, including DDoS.

4. Install DDoS Deflate

DDoS Deflate is a valuable script that leverages the netstat command to identify and block IP addresses that establish too many connections to your server, which is often an indicator of a DDoS attack. By regularly monitoring connections and blocking suspicious IPs, DDoS Deflate can significantly reduce the impact of DDoS attacks on your Apache server.

To install DDoS Deflate, you can follow these simple steps:

1. Download the DDoS Deflate script from the official repository:

wget https://raw.githubusercontent.com/jgmdev/ddos-deflate/master/install.sh


2. Make the script executable and run it:

chmod +x install.sh
./install.sh


Once installed, you can configure key parameters in the /etc/ddos/ddos.conf file, such as:

• NO_OF_CONNECTIONS: The threshold connection limit that, if exceeded by an IP address, will trigger a block (e.g., 150 connections).
• FREQ: The frequency in minutes at which the script will run (e.g., every 5 minutes).

For example, if you set the NO_OF_CONNECTIONS to 150 and the FREQ to 5, the script will check every 5 minutes for IP addresses with more than 150 connections and block them.

Additionally, you can whitelist trusted IP addresses in the /etc/ddos/ignore.ip.list file, preventing them from being blocked by the script.

It’s essential to monitor the script’s performance and adjust the parameters as needed to optimize its effectiveness without causing unintended consequences, such as blocking legitimate users who may have a higher than average number of connections.

By employing DDoS Deflate as part of your DDoS prevention strategy, you can proactively identify and block potential DDoS attacks, enhancing the security and stability of your Apache web server.

5. Use a Software Firewall

Software firewalls provide an additional layer of protection against DDoS attacks by limiting the number of connections on Apache web server ports. They work by filtering incoming and outgoing network traffic based on predefined rules, effectively reducing the impact of DDoS attacks. Two popular software firewalls are ConfigServer Security & Firewall (CSF) and iptables.

ConfigServer Security & Firewall (CSF)

CSF is a powerful software firewall that integrates with the Linux operating system and several control panel systems like cPanel. It provides an easy-to-use interface for managing firewall rules.

To install CSF, follow these steps:

1. Download the CSF installation package:

wget https://download.configserver.com/csf.tgz


2. Extract the package and run the installation script:

tar -xzf csf.tgz
cd csf
./install.sh


3. Configure the CSF settings in the /etc/csf/csf.conf file. Some key parameters to adjust include:

• SYNFLOOD: Enable (1) or disable (0) SYN flood protection.
• PORTFLOOD: Configure the number of connections per time interval allowed for specific ports (e.g., 22;tcp;5;300, which allows a maximum of 5 connections to port 22 every 300 seconds).

Iptables

Iptables is a command-line utility for configuring the Linux kernel firewall, allowing you to create custom rules for managing network traffic.

To set up iptables rules for DDoS protection, you can execute the following commands:

1. Limit the number of new connections per IP address:

iptables -A INPUT -p tcp --syn -m connlimit --connlimit-above 10 -j REJECT --reject-with tcp-reset


1. Enable SYN flood protection:

iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A INPUT -p tcp --syn -j DROP


These are just examples. You should adjust the rules to match your specific needs and environment.

Using a software firewall like CSF or iptables is an effective way to add an additional layer of security to your Apache web server. By carefully configuring connection limits and other relevant parameters, you can mitigate the risk of DDoS attacks and maintain the stability and performance of your server.

6. Install Fail2ban

Fail2ban is a powerful intrusion prevention software that protects your Apache web server from DDoS attacks by analyzing server logs and blocking IP addresses that exhibit suspicious behavior. It uses regular expressions to identify patterns in log files that may indicate a DDoS attack and takes action by updating firewall rules to block the offending IPs.

To install Fail2ban and configure it for Apache DDoS protection, follow these steps:

1. Install Fail2ban:

For Ubuntu/Debian systems:

sudo apt-get update
sudo apt-get install fail2ban


For CentOS/RHEL systems:

sudo yum install epel-release
sudo yum install fail2ban


2. Create a new file called jail.local in the /etc/fail2ban directory:

sudo nano /etc/fail2ban/jail.local


3. Add the following lines to the jail.local file to create a custom jail for Apache DDoS protection:

[apache-ddos]
enabled = true
port = http,https
filter = apache-ddos
logpath = /var/log/apache2/access.log
maxretry = 100
findtime = 60
bantime = 3600
action = iptables-multiport[name=apache-ddos, port="http,https", protocol=tcp]


Adjust the parameters as needed:

• maxretry: The number of allowed failed attempts before banning an IP (e.g., 100).
• findtime: The time window in seconds for detecting failed attempts (e.g., 60 seconds).
• bantime: The duration in seconds that an IP will be banned (e.g., 3600 seconds or 1 hour).

4. Create a new file called apache-ddos.conf in the /etc/fail2ban/filter.d directory:

sudo nano /etc/fail2ban/filter.d/apache-ddos.conf


5. Add the following lines to the apache-ddos.conf file to create a custom filter for Apache DDoS protection:

[Definition]
failregex = ^<host> -.*"(GET|POST|HEAD).*HTTP.*" (4[0-9][0-9]|5[0-9][0-9]) .*
ignoreregex =


This filter will match log entries where the IP (<host>) made HTTP requests (GET, POST, HEAD) that resulted in 4xx or 5xx HTTP response codes.

6. Restart the Fail2ban service to apply the new configuration:

sudo systemctl restart fail2ban


By installing and configuring Fail2ban for Apache DDoS protection, you can effectively monitor your server logs for suspicious activity and automatically block malicious IP addresses, enhancing the security and resilience of your web server. Remember to adjust the configuration parameters to suit your specific environment and requirements, as well as monitor the effectiveness of the Fail2ban rules to optimize their performance.

7. Tweak Sysctl-Based Protection

Sysctl-based protection involves adjusting kernel parameters in the /etc/sysctl.conf file to enhance your server’s ability to handle excessive network traffic that may be associated with DDoS attacks. Modifying these parameters can help mitigate attacks by managing connection states and timeouts more effectively.

For example, you can tweak the values set for SYN_SENT, SYN_RECV, TIME_WAIT, and FIN_WAIT states, which control how long connections stay open and how many connections are allowed. By adjusting these values, your server can better handle a high volume of incoming requests while minimizing the impact of potential DDoS attacks.

Here’s a sample of sysctl parameters to optimize for DDoS protection:

After modifying the /etc/sysctl.conf file, run sudo sysctl -p to apply the changes. By optimizing these settings, your Apache server will be better equipped to handle potential DDoS attacks, improving its resilience and overall performance.

8. Use a Load Balancer

Load balancers play a crucial role in mitigating DDoS attacks on web servers by distributing incoming traffic across multiple servers, reducing the impact of high volumes of requests on a single server. By employing a load balancer such as HAProxy or NGINX, you can enhance your server’s ability to handle traffic spikes associated with DDoS attacks while maintaining optimal performance.

Here are a few ways to configure your load balancer for better DDoS protection:

1. Limit connections per user: By restricting the number of simultaneous connections allowed per user or IP address, you can prevent attackers from opening a large number of connections to exhaust server resources. For example, in HAProxy, you can set the conn_limit parameter for a specific backend:

backend example_backend
...
acl too_many_conn_by_user src_conn_rate(example_backend) ge 50
tcp-request connection reject if too_many_conn_by_user
...


2. Limit HTTP request rate: To protect against HTTP flood attacks, you can configure the load balancer to limit the rate of HTTP requests per user or IP address. In NGINX, you can use the limit_req directive:

http {
...
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
server {
...
location / {
limit_req zone=mylimit burst=20;
...
}
}
}


3. Deploy a reverse proxy: A reverse proxy can act as an intermediary between clients and your server, helping to filter out malicious requests before they reach your Apache server. Both HAProxy and NGINX can function as reverse proxies, offering additional protection against DDoS attacks.

4. Use SSL termination: SSL termination can offload the SSL decryption process from your Apache server to the load balancer, reducing the server’s resource usage during a DDoS attack. This can be achieved using the ssl directive in HAProxy or the ssl_certificate and ssl_certificate_key directives in NGINX.

5. Configure health checks: Ensuring that the load balancer monitors the health of your backend servers allows it to automatically remove any server that becomes unresponsive due to a DDoS attack. This helps maintain availability and performance. In HAProxy, you can use the option httpchk directive, while in NGINX, you can use the health_check directive.

By implementing these measures in your load balancer configuration, you can significantly improve your Apache server’s resilience against DDoS attacks, ensuring that your website remains accessible and performs optimally even under heavy traffic conditions.

Pros and Cons of Each Method

In this section, we will evaluate the benefits and limitations of each method for preventing DDoS attacks in Apache, and discuss the potential impact on website performance, security, and user experience.

1. mod_evasive Apache module
   • Pros: Effective against HTTP-based attacks, easy to configure, and low impact on server performance.
   • Cons: Limited to Apache-based attacks, may produce false positives, and not effective against all types of DDoS attacks.
2. mod_security module
   • Pros: Acts as a web application firewall, provides protection against a wide range of attacks, and offers advanced filtering options.
   • Cons: Complex configuration, can cause false positives, and may impact server performance if not tuned correctly.
3. DDoS deflate
   • Pros: Lightweight, simple to configure, and works with various server configurations.
   • Cons: Limited in scope, may not be effective against sophisticated DDoS attacks, and may cause false positives.
4. Software firewall
   • Pros: Provides protection against various types of DDoS attacks, offers granular control over traffic, and can be easily updated with new rules.
   • Cons: May impact server performance if not configured correctly, can be complex to set up, and may cause false positives.
5. Fail2ban
   • Pros: Monitors server logs for malicious activity, automatically bans offending IPs, and can be customized to protect against specific threats.
   • Cons: Requires regular expression knowledge for custom filters, may produce false positives, and may not be effective against distributed DDoS attacks.
6. Apache configuration
   • Pros: No additional software required, optimizes server performance, and reduces the impact of DDoS attacks.
   • Cons: May require advanced knowledge of Apache, may not protect against all types of attacks, and requires ongoing monitoring and maintenance.
7. Sysctl-Based protection
   • Pros: Enhances server’s ability to handle excessive network traffic, offers better control over connection states, and can be applied without additional software.
   • Cons: Requires advanced knowledge of kernel parameters, may not be effective against all types of DDoS attacks, and may require periodic adjustments.
8. Load balancer
   • Pros: Distributes incoming traffic across multiple servers, offers protection against various types of DDoS attacks, and can improve overall server performance and availability.
   • Cons: May require additional hardware or software resources, can be complex to set up and maintain, and may not be suitable for small-scale websites or applications.

Each method has its own strengths and weaknesses, and the best approach to DDoS prevention is to combine different methods and tools to create a multi-layered defense strategy. This ensures that your Apache web server remains protected against a wide range of attacks while maintaining optimal performance and user experience.

Conclusion

DDoS attacks pose a significant threat to Apache web servers, potentially causing downtime, data loss, and reputational damage. Protecting your server from these attacks should be a top priority for website owners and administrators. We have outlined the top 8 methods for preventing DDoS attacks in Apache and evaluated the pros and cons of each approach, allowing you to make informed decisions about the best strategies to safeguard your server.

To recap the key takeaways:

1. Install mod_evasive and mod_security modules to protect against Apache-specific attacks.
2. Use DDoS Deflate and Fail2ban to monitor server logs and automatically block malicious IPs.
3. Employ software firewalls and tweak Apache configuration for enhanced security and performance.
4. Utilize sysctl-based protection to fine-tune kernel parameters and optimize server response.
5. Set up a load balancer to distribute traffic across multiple servers, ensuring better resilience against DDoS attacks.

Remember, a multi-layered approach to DDoS prevention that combines different methods and tools is essential to ensure comprehensive protection. By implementing these strategies, you can effectively mitigate the risk of DDoS attacks and maintain a stable, secure, and high-performing Apache web server.

We hope that this article has provided valuable insights and guidance on how to protect your Apache server from DDoS attacks. We encourage you to explore the methods discussed and find the best combination of strategies to suit your specific needs and server environment.

As always, we welcome your thoughts, experiences, and questions in the comments section below. Sharing your knowledge and experiences with the community can help others better protect their Apache servers against DDoS attacks. Let’s work together to create a more secure and resilient digital landscape for everyone.