#1150890 libapache2-mod-evasive: DOSWhitelist options from the evasive.conf are ignored

Package:
libapache2-mod-evasive
Source:
libapache2-mod-evasive
Description:
evasive module to minimize HTTP DoS or brute force attacks
Submitter:
Aurélien LUBERT
Date:
2026-10-14 12:51:03 UTC
Severity:
normal
#1150890#5
Date:
2026-10-14 12:39:10 UTC
From:
To:
Dear Maintainer,

I have installed this package from the stable repository and the
current version does not allow to declare IP addresses to ignore
with the DOSWhitelist option.

I set the following minimal configuration by modifying the file
/etc/apache2/mods-enabled/evasive.conf:

         DOSEnabled true
         DOSWhitelist 127.0.0.1
         DOSWhitelist ::1

(For information, the DOSEnabled is not available in the default
configuration file and can lead to misinterpretation, since the
default value is false).

After the reloading of the apache2 server, I expect the requests
from 127.0.0.1 to be ignored, but I can see the following entry
in the /var/log/apache2/error.log after some tests (with ab):

         Blacklisting address 127.0.0.1: possible DoS attack.

I tried the version 2.4.0-3 from the testing repository and this
problem seems to be fixed.