-1

From time to time, I'm visited by "leechers" downloading an entire site (~2 GB) within a few hours, while the average visitor stays far below 50 MB. I'd like to setup a "byte-limit" per visitor (e.g. allowing max 100 MB per day and visitor).

Apache::Quota pretty much seems to do that, but its latest version (0.04) dates back to 2007 and is for Apache 1.3. I prefer a more "native" solution (not requiring mod_perl).

Requirements

  • must be able to limit the amount of transferred bytes per client/IP and time frame (e.g. each visitor is permitted 100 MB per day). I'm not interested in "bandwidth throtteling".
  • must work with Apache 2.2

Strongly preferred

  • works as an Apache module (i.e. simply loading and configuring the module is sufficient)

Nice to have

  • works with Apache 2.4 as well (so it's "future-safe")
  • offers an interface for monitoring, similar to Apache's own /server-status

TL;DR

I've already google'd for days, and checked out solutions I found:

  • Mod_cband looked very promising (including its status page). Unfortunately (if I didn't miss anything), quotas can only be setup per VHost or per "known IP" (i.e. one has to specify the IP the quota should apply to). Both are not practical/useful for my case.
  • I already use mod_evasive for other stuff. Unless I missed something here, it cannot establish "byte quotas" at all, but only control "hit based" (requests per time-unit), so it doesn't fit my requirements either.
  • Apache::Quota is no longer maintained, and as far as I understood only for Apache 1.3
  • there might be a recipe for mod_security, but I didn't find any yet. As I'm already using mod_security on the server in question, this kind of solution would be very much welcome as well.

PS:

If there's no suitable Apache module (or other Apache-based solution), I'm also open to alternative approaches – e.g. a tool managing that based on iptables (restricted to the specific ports of course). If you recommend this kind of solution, please elaborate detailed on how to achieve my goal, as I've close to none experience with iptables rules ;)

  • Thanks for criticising by downvoting! In order for me to learn where I failed, it would help to leave a comment explaining why this question "does not show any research effort, is unclear or not useful" (which are the criteria for a downvote). Thanks! – Izzy Oct 7 '15 at 8:27
0

Not really an alternative to Apache::Quota, but working fine for my underlying issue:

Fail2ban can be used to limit access per visitor – at least when one can tell "abuse" from "normal use". That was the case for me: visitors usually browse a lot of pages, and then download a few resources – while leechers download all resources they come across. As each "normal page" links at least 1 "resource", a leecher grabs more per hour than a normal visitor per day. Assuming my resources are found below /downloads, but my pages are not, I define the following filter in /etc/fail2ban/filter.d/apache-leecher.conf:

[Definition]
# Match all our resources below /downloads:
failregex = ^ -.*"(GET|POST) /download.*"

With that, I setup a jail in /etc/fail2ban/jail.conf:

[apache-leecher]
# download 100+ files per hour (3600s), and you'll be blocked for 6h (21600s)
enabled = true
port    = http,https
filter  = apache-leecher
logpath = /var/log/httpd/access_log
maxretry = 100
findtime = 3600
bantime  = 21600

Assuming 50 hits per day being quite much for a normal visitor, "decent users" should not be affected. If someone grabs 100 files per hour, I no longer count that "fair use" but completely ban the IP for 6 hours. As the values are configurable, they can of course be adjusted for slightly different use-cases :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.