From time to time, I'm visited by "leechers" downloading an entire site (~2 GB) within a few hours, while the average visitor stays far below 50 MB. I'd like to setup a "byte-limit" per visitor (e.g. allowing max 100 MB per day and visitor).
Apache::Quota pretty much seems to do that, but its latest version (0.04) dates back to 2007 and is for Apache 1.3. I prefer a more "native" solution (not requiring
- must be able to limit the amount of transferred bytes per client/IP and time frame (e.g. each visitor is permitted 100 MB per day). I'm not interested in "bandwidth throtteling".
- must work with Apache 2.2
- works as an Apache module (i.e. simply loading and configuring the module is sufficient)
Nice to have
- works with Apache 2.4 as well (so it's "future-safe")
- offers an interface for monitoring, similar to Apache's own
I've already google'd for days, and checked out solutions I found:
- Mod_cband looked very promising (including its status page). Unfortunately (if I didn't miss anything), quotas can only be setup per VHost or per "known IP" (i.e. one has to specify the IP the quota should apply to). Both are not practical/useful for my case.
- I already use mod_evasive for other stuff. Unless I missed something here, it cannot establish "byte quotas" at all, but only control "hit based" (requests per time-unit), so it doesn't fit my requirements either.
- Apache::Quota is no longer maintained, and as far as I understood only for Apache 1.3
- there might be a recipe for mod_security, but I didn't find any yet. As I'm already using
mod_securityon the server in question, this kind of solution would be very much welcome as well.
If there's no suitable Apache module (or other Apache-based solution), I'm also open to alternative approaches – e.g. a tool managing that based on iptables (restricted to the specific ports of course). If you recommend this kind of solution, please elaborate detailed on how to achieve my goal, as I've close to none experience with iptables rules ;)