The below seems to be blocking all visitors, yet if i comment out the specific IP the site loads for everyone.
Its added via security however, is blocking everyone out rather than just the specific IP targeted.
I have contacted our hosts and they claim it's nothing to do with them, but surely it's how they have their Apache configured?
SetEnvIF REMOTE_ADDR "^66\.249\.66\.217$" DenyAccess
SetEnvIF X-FORWARDED-FOR "^66\.249\.66\.217$" DenyAccess
SetEnvIF X-CLUSTER-CLIENT-IP "^66\.249\.66\.217$" DenyAccess
<IfModule mod_authz_core.c>
<RequireAll>
Require all granted
Require not env DenyAccess
Require not ip 66.249.66.217
</RequireAll>
</IfModule>
<IfModule !mod_authz_core.c>
Order allow,deny
Allow from all
Deny from env=DenyAccess
Deny from 66.249.66.217
</IfModule>
The directives seem to work as is.
To debug this, I would first verify, if mod_authz_core is enabled or not.
Based on this, you may check, which of the directives are causing the block, either the environment directive
Require not env DenyAccess
Deny from env=DenyAccess
or the ip directive
Require not ip 66.249.66.217
Deny from 66.249.66.217
If the environment is the culprit, check which of the variables is causing it, by commenting one by one.
Related
I have the following folder structure
domain.com (/public_html/)
sub.domain.com (/public_html/sub/)
sub.domain.com/dir1/ (/public_html/sub/dir1/)
sub.domain.com/dir1/dir2/ (/public_html/sub/dir1/dir2/)
if I put the following in my .htaccess file at any of these directories
DirectoryIndex index.php
require valid-user
<RequireAny>
Require ip x.x.x.x
</RequireAny>
It has no effect when loading any files in these directories.
Additionally if i want multiple require rules to have and/or then it gets a little more complicated for example
# Allowing Access via Password or one of the following IP Addresses
AuthName "Authorized Only"
AuthType Basic
AuthUserFile /home/.htpasswds/.htpasswd
<RequireAll>
require valid-user
<RequireAny>
Require ip x.x.x.x
Require ip y.y.y.y
</RequireAny>
</RequireAll>
Apache did follow these rules set, but switching to litespeed enterprise web server has meant that IP restrictions have been ignored
What am I missing here?
require valid-user
<RequireAny>
Require ip x.x.x.x
</RequireAny>
This would seem to be overkill for Apache 2.4. <RequireAny> is the default container. The above 4 lines is the same as the one-line Require ip x.x.x.x.
However, my experience with LiteSpeed is that it behaves more like an Apache 2.2 server and (annoyingly) silently fails on directives it does not understand (although there might be something logged in the server's error log).
Try the following (Apache 2.2 style) directives instead:
Order Allow,Deny
Allow from x.x.x.x
I need to deny certain IP's all access but I can't see any deny.
I put this code on my ssl.conf inside label VirtualHost
<LocationMatch "/.*">
Order Allow,Deny
Allow from all
SetEnvif X-Forwarded-For "93\.176\.144\.153" DenyAccess
SetEnvif X-Forwarded-For "139\.162\.206\.138" DenyAccess
Deny from env=DenyAccess
</LocationMatch>
Why not run correctly this configuration?
Thanks in advance
This method does not work? Even in an .htaccess file?
Order Allow,Deny
Allow from all
Deny from 93.176.144.153 139.162.206.138
I've been trying for some hours block all connection except my domain in httpd config. but I'm not able to connect with my own domain. I just get Forbidden page.
<VirtualHost *:80>
ServerName Server-VM
DocumentRoot /var/www/
SetEnvIf Referer domain\.cc internal
<FilesMatch "\.(avi|mp4)$">
Order Deny,Allow
Deny from all
Allow from env=internal
</FilesMatch>
</VirtualHost>
My Apache version: 2.2.15
What am I doing wrong?
Thank you!
The Allow, Deny, and Order directives, provided by mod_access_compat, are deprecated and will go away in a future version. You should avoid using them, and avoid outdated tutorials recommending their use.
Try
<FilesMatch "\.(avi|mp4)$">
Require host domain.cc
</FilesMatch>
More info from https://httpd.apache.org/docs/2.4/howto/access.html
I'm using Magento 1.6.2.0., Apache, Fast CGI, OpenSUSE
I have set up Multi Store successfully by redirecting a different domain using vhost.conf and vhost_ssl.conf, and by altering the .htaccess in the 'root' domain. I need to do it this way because I need 2 separate IP addresses and 2 SSL certs. The redirect works and I have been able to skin the new domain to my liking.
.htaccess:
SetEnvIf Host .*domain.* MAGE_RUN_CODE=domain_code
SetEnvIf Host .*domain.* SetEnv MAGE_RUN_TYPE=website
vhost_ssl.conf:
<IfModule mod_suexec.c>
SuexecUserGroup "user" "xxxx"
</IfModule>
DocumentRoot "/var/www/vhosts/domain.co.uk/dev.domain.co.uk"
<Directory /var/www/vhosts/domain.co.uk/dev.domain.co.uk>
<IfModule mod_fcgid.c>
<Files ~ (\.php)>
SetHandler fcgid-script
FCGIWrapper /var/www/cgi-bin/cgi_wrapper/cgi_wrapper .php
Options +ExecCGI
allow from all
</Files>
</IfModule>
SSLRequireSSL
Options -Includes -ExecCGI
</Directory>
My concern is that whenever I try to navigate to an https:// page I get a redirect loop in the browser.
I have no SSL cert set up for this domain, but to my mind this should not create this error, but rather a 'no cert' error (if anything).
I was hoping that someone might be able to point out a solution that they have had in the past.
Thanks for any time that anyone spends on this.
I've look all over, but keeps running into same info that talks about directory level IP restriction, which usually looks something like this:
Order Deny,Allow
Deny from all
Allow from 123.123.123.123
Is it possible to have same type of access restriction tied to a page/document?
This will allow either someone from IP 127.0.0.1 or logged as a valid user. Stick it either in your config or .htaccess file.
<Files learn.php>
Satisfy any
Order deny,allow
Deny from all
Allow from 127.0.0.1
AuthType Basic
AuthName "private"
AuthUserFile /var/www/phpexperts.pro/.htpasswd
AuthGroupFile /dev/null
Require valid-user
</Files>
IP Alone:
<Files learn.php>
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Files>
That definitely answers your question.
I think the directive needs to be:
Order deny,allow
for the answer above to work (at least for the IP Alone solution).
Mod-rewrite based solution :
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^Y\.O\.U\.R\.IP$
RewriteRule ^file\.php$ - [F,L]
The rewriteRule above will deny all requests to file.php if client ip does not match the ip address in the RewriteCond's pattern
For a more up to date Apache 2.4 example:
<Files file.html>
Require ip 123.123.123.123
</Files>
Here are the more in depth docs for additional options and examples: https://httpd.apache.org/docs/2.4/howto/access.html and the docs for the <Files> directive: https://httpd.apache.org/docs/2.4/mod/core.html#files
Note that <Files> can be nested inside <Directory> sections to restrict the portion of the filesystem they apply to.