Configure Apache rate limiting and DDoS protection with mod_security and mod_evasive

#!/usr/bin/env bash
set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
ADMIN_EMAIL="${1:-admin@example.com}"
WHITELIST_IP="${2:-127.0.0.1}"

# Usage
if [[ $# -gt 2 ]]; then
    echo "Usage: $0 [admin_email] [whitelist_ip]"
    echo "Example: $0 admin@example.com 192.168.1.0/24"
    exit 1
fi

# Check if running as root/sudo
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}Error: This script must be run as root or with sudo${NC}"
    exit 1
fi

# Cleanup function
cleanup() {
    echo -e "${RED}Error occurred. Cleaning up...${NC}"
    systemctl stop apache2 httpd 2>/dev/null || true
}
trap cleanup ERR

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            APACHE_SERVICE="apache2"
            APACHE_CONFIG_DIR="/etc/apache2"
            APACHE_LOG_DIR="/var/log/apache2"
            MODSEC_CONFIG="/etc/modsecurity"
            ENABLE_MOD="a2enmod"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            APACHE_SERVICE="httpd"
            APACHE_CONFIG_DIR="/etc/httpd"
            APACHE_LOG_DIR="/var/log/httpd"
            MODSEC_CONFIG="/etc/httpd/modsecurity.d"
            ENABLE_MOD=""
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            APACHE_SERVICE="httpd"
            APACHE_CONFIG_DIR="/etc/httpd"
            APACHE_LOG_DIR="/var/log/httpd"
            MODSEC_CONFIG="/etc/httpd/modsecurity.d"
            ENABLE_MOD=""
            ;;
        *)
            echo -e "${RED}Unsupported distro: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect OS. /etc/os-release not found${NC}"
    exit 1
fi

echo -e "${GREEN}Configuring Apache with DDoS protection on $PRETTY_NAME${NC}"

# Step 1: Update system packages
echo -e "${YELLOW}[1/8] Updating system packages...${NC}"
$PKG_UPDATE

# Step 2: Install Apache and security modules
echo -e "${YELLOW}[2/8] Installing Apache and security modules...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL apache2 libapache2-mod-evasive libapache2-mod-security2 modsecurity-crs libapache2-mod-limitipconn
else
    $PKG_INSTALL httpd mod_evasive mod_security mod_security_crs mod_limitipconn
fi

# Step 3: Install fail2ban
echo -e "${YELLOW}[3/8] Installing fail2ban...${NC}"
$PKG_INSTALL fail2ban

# Step 4: Enable Apache security modules
echo -e "${YELLOW}[4/8] Enabling Apache security modules...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $ENABLE_MOD evasive
    $ENABLE_MOD security2
    $ENABLE_MOD limitipconn
    $ENABLE_MOD headers
    $ENABLE_MOD rewrite
else
    systemctl enable $APACHE_SERVICE
fi

# Step 5: Configure mod_evasive
echo -e "${YELLOW}[5/8] Configuring mod_evasive...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    EVASIVE_CONFIG="$APACHE_CONFIG_DIR/mods-available/evasive.conf"
else
    EVASIVE_CONFIG="$APACHE_CONFIG_DIR/conf.d/mod_evasive.conf"
fi

cat > "$EVASIVE_CONFIG" << EOF
<IfModule mod_evasive24.c>
    DOSHashTableSize     512
    DOSPageCount         3
    DOSPageInterval      1
    DOSSiteCount         50
    DOSSiteInterval      1
    DOSBlockingPeriod    600
    DOSLogDir            "$APACHE_LOG_DIR"
    DOSEmailNotify       $ADMIN_EMAIL
    DOSWhitelist         $WHITELIST_IP
</IfModule>
EOF

chown root:root "$EVASIVE_CONFIG"
chmod 644 "$EVASIVE_CONFIG"

# Step 6: Configure mod_security
echo -e "${YELLOW}[6/8] Configuring mod_security...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
    sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/modsecurity/modsecurity.conf
    sed -i 's/SecAuditLogParts ABIJDEFHZ/SecAuditLogParts ABCEFHJKZ/' /etc/modsecurity/modsecurity.conf
else
    mkdir -p "$MODSEC_CONFIG"
    cp /etc/httpd/modsecurity.d/modsecurity.conf-recommended /etc/httpd/modsecurity.d/modsecurity.conf 2>/dev/null || true
    sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/httpd/modsecurity.d/modsecurity.conf 2>/dev/null || true
    sed -i 's/SecAuditLogParts ABIJDEFHZ/SecAuditLogParts ABCEFHJKZ/' /etc/httpd/modsecurity.d/modsecurity.conf 2>/dev/null || true
fi

# Step 7: Create Apache security configuration
echo -e "${YELLOW}[7/8] Creating Apache security configuration...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    SECURITY_CONF="$APACHE_CONFIG_DIR/conf-available/security-hardening.conf"
    mkdir -p "$(dirname "$SECURITY_CONF")"
else
    SECURITY_CONF="$APACHE_CONFIG_DIR/conf.d/security-hardening.conf"
fi

cat > "$SECURITY_CONF" << EOF
# Security Headers
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

# Hide Apache version
ServerTokens Prod
ServerSignature Off

# Connection limiting
<IfModule mod_limitipconn.c>
    MaxConnPerIP 10
</IfModule>

# Basic rate limiting
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteMap requests txt:$APACHE_LOG_DIR/requests.map
    RewriteCond \${requests:\%{REMOTE_ADDR}|0} >20
    RewriteRule ^(.*)$ - [F,L]
</IfModule>
EOF

chown root:root "$SECURITY_CONF"
chmod 644 "$SECURITY_CONF"

if [[ "$PKG_MGR" == "apt" ]]; then
    a2enconf security-hardening
fi

# Configure fail2ban
cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[apache-auth]
enabled = true
port = http,https
logpath = $APACHE_LOG_DIR/error.log

[apache-badbots]
enabled = true
port = http,https
logpath = $APACHE_LOG_DIR/access.log

[apache-noscript]
enabled = true
port = http,https
logpath = $APACHE_LOG_DIR/access.log

[apache-overflows]
enabled = true
port = http,https
logpath = $APACHE_LOG_DIR/error.log
EOF

# Step 8: Start and enable services
echo -e "${YELLOW}[8/8] Starting and enabling services...${NC}"
systemctl enable $APACHE_SERVICE
systemctl enable fail2ban

# Create log directory if it doesn't exist
mkdir -p "$APACHE_LOG_DIR"
chown www-data:www-data "$APACHE_LOG_DIR" 2>/dev/null || chown apache:apache "$APACHE_LOG_DIR" 2>/dev/null || true

# Test Apache configuration
if ! $APACHE_SERVICE -t 2>/dev/null && ! httpd -t 2>/dev/null; then
    echo -e "${RED}Apache configuration test failed${NC}"
    exit 1
fi

systemctl restart $APACHE_SERVICE
systemctl restart fail2ban

# Verification
echo -e "${GREEN}Verifying installation...${NC}"
if systemctl is-active --quiet $APACHE_SERVICE; then
    echo -e "${GREEN}✓ Apache is running${NC}"
else
    echo -e "${RED}✗ Apache is not running${NC}"
fi

if systemctl is-active --quiet fail2ban; then
    echo -e "${GREEN}✓ Fail2ban is running${NC}"
else
    echo -e "${RED}✗ Fail2ban is not running${NC}"
fi

echo -e "${GREEN}Apache DDoS protection configuration complete!${NC}"
echo -e "${YELLOW}Configuration details:${NC}"
echo "- Admin email: $ADMIN_EMAIL"
echo "- Whitelisted IP: $WHITELIST_IP"
echo "- Apache service: $APACHE_SERVICE"
echo "- Log directory: $APACHE_LOG_DIR"
echo ""
echo -e "${YELLOW}To test the configuration:${NC}"
echo "sudo $APACHE_SERVICE -t"
echo "sudo fail2ban-client status"