how to prevent apache getting stuck after fail2ban jail triggers?

apache on a small machine is running with mpm_prefork and mod_evasive. fail2ban is monitoring its logs. When a badly-behaved scraper ignores 429 responses and continues to bombard the website, its IP address is blocked. However, this sometimes leaves all the apache servers stuck and the website becomes unviewable until apache is restarted. If I manually run netstat when the website is "down", I see that all the servers are connected to the blocked IP address. I assume they are waiting for traffic that will never arrive. How may I prevent this problem? My first thought is to trigger a script when fail2ban triggers which does something like: lsof -ni TCP:443 | awk '$9~ip{print "kill",$2}' ip= but I assume I am not the first to encounter this problem and there is already an established solution (which I have not yet found). The mpm_prefork configuration is: StartServers 3 MinSpareServers 3 MaxSpareServers 6 MaxRequestWorkers 50 MaxConnectionsPerChild 0 The mod_evasive configuration is: DOSEnabled true DOSHashTableSize 1000 DOSPageCount 10 DOSPageInterval 1 DOSSiteCount 50 DOSSiteInterval 5 DOSBlockingPeriod 20 DOSHTTPStatus 429
Take Your Experience to the Next Level
NewDownload our mobile app for a faster and better experience.
Comments
0U
Join the discussion
Sign in to leave a comment