SolidServers.ca

We are going to install mod_limitipconn in order to limit the number of connections per IP on our server.  This can be a very useful tool, as it could help in lowering the load on your server due to someone connecting too many times from the same IP.

More information about mod_limitipconn can be found here – http://dominia.org/djao/limitipconn.html.  There are two versions, one for Apache 1.3, and the other, for Apache 2.x.  We are going to install the 2.x version on our cPanel server.  Here is the link to more information regarding 2.x – http://dominia.org/djao/limitipconn2.html.

To get starting, we need to logged into our system as the root user, so please, do this now.

I always download everything to my downloads folder, so, we change to it:

root@server [~] # cd downloads

Now, we need to grab the file (this is the latest version as of this post):

root@server [~/downloads] # wget http://dominia.org/djao/limit/mod_limitipconn-0.23.tar.bz2

Of course, we now need to extract them:

root@server [~/downloads] # tar xjvf mod_limitipconn-0.23.tar.bz2

Now, change into the directory that was just created:

root@server [~/downloads] #cd mod_limitipconn-0.23

Now, we compile the module into Apache using:

root@server [~/downloads] #/usr/local/apache/bin/apxs -i -a -c mod_limitipconn.c

Now, that will create an entry in the httpd.conf file, and, if we want to retain that after an upgrade/rebuild, we need to tell cPanel not to take it out!  Do do this, we now run this:

root@server [~/downloads] # /usr/local/cpanel/bin/apache_conf_distiller –update

To change the configuration settings for mod_limitipconn, we need to add them in some place.  All we have done so far, is install the actually module into apache, and, even with a restart, it would not be using it.  So, I like to add things into my includes files through either WHM, or, directly through the terminal.  To do this, we run the following:

root@server [~/downloads] # vim /usr/local/apache/conf/includes/pre_virtualhost_global.conf

Once the file is open, lets add in the following lines to the bottom of the file:

ExtendedStatus On
<IfModule mod_limitipconn.c>
<Location />
MaxConnPerIP 10
NoIPLimit image/*
NoIPLimit image*/*
</Location>
</IfModule>

Once done, save the file, this varies depending on your editor of choice, in VI and VIM, its :wq enter.

Here is a copy from the readme file for the variables that can be configured :

This is an Apache 2.2 C module whose purpose is to limit the maximum
number of simultaneous connections per IP address. The module allows
inclusion and exclusion of files based on MIME type.

This module _may_ work for Apache 2.0, but has not been tested in that
setting.

Example configuration:

—————————————————————————

# This command is always needed
ExtendedStatus On

# Only needed if the module is compiled as a DSO
LoadModule limitipconn_module lib/apache/mod_limitipconn.so

<IfModule mod_limitipconn.c>

# Set a server-wide limit of 10 simultaneous downloads per IP,
# no matter what.
MaxConnPerIP 10
<Location /somewhere>
# This section affects all files under http://your.server/somewhere
MaxConnPerIP 3
# exempting images from the connection limit is often a good
# idea if your web page has lots of inline images, since these
# pages often generate a flurry of concurrent image requests
NoIPLimit image/*
</Location>

<Directory /home/*/public_html>
# This section affects all files under /home/*/public_html
MaxConnPerIP 1
# In this case, all MIME types other than audio/mpeg and video*
# are exempt from the limit check
OnlyIPLimit audio/mpeg video
</Directory>
</IfModule>

—————————————————————————

Notes:

1) This module will not function unless mod_status is loaded and the
“ExtendedStatus On” directive is set.

2) Server-wide access restrictions and per-directory access restrictions
are computed separately.  In the above example, if someone is
downloading 11 images from http://your.server/somewhere
simultaneously, they WILL be denied on the 11th download, because the
server-wide limit of 10 downloads is not affected by the per-directory
NoIPLimit.  If you want to set global settings which can be overruled
by per-directory settings, you will need something like

<Location />
# global per-directory settings here

<Location /somewhere>
# local per-directory settings here

</Location>

</Location>

3) If you are using any module based upon a quick handler hook (such as
mod_cache), mod_limitipconn will not be able to process any
per-directory configuration directives in time to affect the return
result of the other module.  This is a technical limitation imposed
by Apache.  In such a situation, you will have to use server-wide
configuration directives only.

Note that previous versions of mod_limitipconn did not allow any
server-wide configuration directives, and hence could not be used
with mod_cache at all.  In other words, the present situation still
represents an improvement over previous versions.

4) The limits defined by mod_limitipconn.c apply to all IP addresses
connecting to your Apache server. Currently there is no way to set
different limits for different IP addresses.

5) Connections in excess of the limit result in a stock 503 Service
Temporarily Unavailable response. The job of returning a more useful
error message to the client is left as an exercise for the reader.

6) mod_limitipconn sets the LIMITIP environment variable to 1 whenever a
download is denied on the basis of too high an IP count. You can use
this variable to distinguish accesses that have been denied by this
module. For example, a line like

CustomLog /var/log/httpd/access_log common env=!LIMITIP

in httpd.conf can be used to suppress logging of denied connections
from /var/log/httpd/access_log. (Note that, if you really want to
suppress logging, you’ll probably also want to comment out the
ap_log_rerror lines from mod_limitipconn.c as well.)

7) By default, all clients behind a proxy are treated as coming from the
proxy server’s IP address. If you wish to alter this behavior,
consider installing mod_extract_forwarded from
http://web.warhound.org/mod_extract_forwarded/