Via htaccess, I would like to:
1 - Disallow everyone to access the site.
2 - Allow only 3 ips to pass through the ip ban.
3 - Leave 1 directory accessible fully to the public.
I understand the the rule number 3 goes against rule number 1, and this is where I am confused.
Currently I have this code:
<Files 403.shtml>
order deny,allow
deny from all
</Files>
allow from xxx.xxx.xxx.xx #Fred
allow from xxx.xxx.xxx.xxx #Ben
The above code works fine in not letting anyone in apart from my 3 coworkers.
<Directory /printing/>
Order Allow, Deny
Allow from All
</Directory>
The above code (when added) give me a 500 internal server error.
How to have a mix of both code so people can still access my directory publicly while blocking access to any other parts of the website?
You can't add a <Directory> container inside an htaccess file, since htaccess is already per-directory.
What you need to do is create an htaccess file in the printing directory with just:
Order Allow, Deny
Allow from All
is there a way in Apache, when using the mod_authnz_ldap module, to only have it ask for a login if the IP address is not within a defined, internal range? We have a site that we don't want people to have to log in from when they are in the office but when out of the office - from home or mobile etc they should have to authenticate.
Possible?
yes it is possible.
Asuming you use the LDAP authorization on a per Location basis:
<Location /your/path/here>
Order deny,allow
Deny from all
Allow from 192.168.0.
Auth...
<your complete ldap config here>
# if one of the above matches, go on
Satisfy any
</Location>
You can find the complete documentation for satisfy here
I have a directory on my website that I need to make sure no one but myself can get into. From the reading I've done, it looks like there are two ways to protect a directory:
Password protect the directory using the .htaccess file
Deny access to all IP addresses but my own from accessing the directory, also using the .htaccess file
I need to protect the files in the directory as securely as possible, so I figured I'd use both of those methods for double protection.
Question 1: Am I missing anything? (i.e. is there another layer of protection I can add?)
Question 2: What would I need to put in a .htaccess file to get the above to work?
Your .htaccess file would contain:
AuthUserFile /usr/local/nate/safe_place/.htpasswd
AuthGroupFile /dev/null
AuthName "Protected Files"
AuthType Basic
require user nate
order deny, allow
deny from all
allow from 127.0.0.1
The .htaccess file goes in the directory you're trying to protect.
You also need a .htpasswd file (shown above as /usr/local/nate/safe_place/.htpasswd) which contains the text username:password_hash. So if we use "nate" as an example and "secret" as the password (please don't use that) you get:
nate:XmN6pwFyy3Il2
You can use this tool to generate your own password file: http://www.tools.dynamicdrive.com/password/
Just make sure that no one can read your .htpasswd file. Also note that basic authentication does no encryption by itself. If you're on an open network, anyone can see your password and all the secret data going over the network. Make sure you visit your site via https if it's really that secret.
You can read more about .htaccess files here:
http://www.javascriptkit.com/howto/htaccess.shtml
Assuming you're running Apache and have an AllowOverride directive permitting .htaccess files to use <Limit>, the following should be a good starting place for you:
<Limit GET>
Order deny,allow
Deny from all
Allow from IP_ADDRESS_HERE
</Limit>
More documentation on <Limit>: http://httpd.apache.org/docs/current/mod/core.html#limit
and for access control: http://httpd.apache.org/docs/2.2/howto/access.html
I would like to allow only one country access, but exclude proxies within this country.
This is what I have (shortened version for convenience)
<Limit GET POST>
order deny,allow
deny from all
allow from 139.82.0.0/16
allow from 143.54.0.0/16
allow from 186.192.0.0/11
allow from 186.224.0.0/11
.
deny from 186.201.27.66
deny from 186.201.196.1
deny from 186.214.51.231
deny from 186.237.225.26
</Limit>
But I know this wont work. How do I go about doing this?
Update : for the new apache 2.4 jump directly to the end.
The Order keyword and its relation with Deny and Allow Directives is a real nightmare. It would be quite interesting to understand how we ended up with such solution, a non-intuitive one to say the least.
The first important point is that the Order keyword will have a big impact on how Allow and Deny directives are used.
Secondly, Deny and Allow directives are not applied in the order they are written, they must be seen as two distinct blocks (one the for Deny directives, one for Allow).
Thirdly, they are drastically not like firewall rules: all rules are applied, the process is not stopping at the first match.
You have two main modes:
The Order-Deny-Allow-mode, or Allow-anyone-except-this-list-or-maybe-not
Order Deny,Allow
This is an allow by default mode. You optionally specify Deny rules.
Firstly, the Deny rules reject some requests.
If someone gets rejected you can get them back with an Allow.
I would rephrase it as:
Rule Deny
list of Deny rules
Except
list of Allow rules
Policy Allow (when no rule fired)
The Order-Allow-Deny-mode, or Reject-everyone-except-this-list-or-maybe-not
Order Allow,Deny
This is a deny by default mode. So you usually specify Allow rules.
Firstly, someone's request must match at least one Allow rule.
If someone matched an Allow, you can still reject them with a Deny.
In the simplified form:
Rule Allow
list of Allow rules
Except
list of Deny rules
Policy Deny (when no rule fired)
Back to your case
You need to allow a list of networks which are the country networks. And in this country you want to exclude some proxies' IP addresses.
You have taken the allow-anyone-except-this-list-or-maybe-not mode, so by default anyone can access your server, except proxies' IPs listed in the Deny list, but if they get rejected you still allow the country networks. That's too broad. Not good.
By inverting to order allow,deny you will be in the reject-everyone-except-this-list-or-maybe-not mode.
So you will reject access to everyone but allow the country networks and then you will reject the proxies. And of course you must remove the Deny from all as stated by #Gerben and #Michael Slade (this answer only explains what they wrote).
The Deny from all is usually seen with order deny,allow to remove the allow by default access and make a simple, readable configuration. For example, specify a list of allowed IPs after that. You don't need that rule and your question is a perfect case of a 3-way access mode (default policy, exceptions, exceptions to exceptions).
But the guys who designed these settings are certainly insane.
All this is deprecated with Apache 2.4
The whole authorization scheme has been refactored in Apache 2.4 with RequireAll, RequireAny and RequireNone directives. See for example this complex logic example.
So the old strange Order logic becomes a relic, and to quote the new documentation:
Controling how and in what order authorization will be applied has been a bit of a mystery in the past
Not answering OPs question directly, but for the people finding this question in search of clarity on what's the difference between allow,deny and deny,allow:
Read the comma as a "but".
allow but deny: whitelist with exceptions.
everything is denied, except items on the allow list, except items on the deny list
deny but allow: blacklist with exceptions.
everything is allowed, except items on the deny list, except items on the allow list
allow only one country access, but exclude proxies within this country
OP needed a whitelist with exceptions, therefore allow,deny instead of deny,allow
Just use order allow,deny instead and remove the deny from all line.
Change your code to
<Limit GET POST>
deny from all
allow from 139.82.0.0/16
allow from 143.54.0.0/16
allow from 186.192.0.0/11
allow from 186.224.0.0/11
</Limit>
This way your htaccess will deny every except those that you explicitly allow with allow from..
A proxy within the allow range can easily be overwritten with an additional deny from.. rule.
As Gerben suggested, just change:
order deny,allow
deny from all
to
order allow,deny
And the restrictions will work as you want them to.
Details can be found in Apache's docs.
In apache2, linux configuration
Require all granted
someone trying to access pages like
//mysqladmin//scripts/setup.php
Is it some hack attempt or .. ?
If yes then how i can block its ip from accessing mine website ?
Via htaccess or something else ?
As an update to this old question for those who still land here:
Order Allow Deny are deprecated as of Apache 2.4 and Require should be used.
<RequireAll>
Require all granted
Require not ip 1.2.3.4
</RequireAll>
Ranges, netmasks, etc. can also be specified.
https://httpd.apache.org/docs/2.4/mod/mod_access_compat.html (Deprecated)
https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require
To block special IP addresses you can put the following in a .htaccess file located in your directory, you like to restrict:
order allow,deny
deny from 1.2.3.4
allow from all
Where 1.2.3.4 is the IP you like to block.
But note that IP adresses change users and also attackers change IP adresses.
So this will not secure your application and potentially block leagal visitors.
The better solution will be to make sure your script does not accept malicious paths.
Append a base path to the path you get from the user
Make sure the path you get from the user does not contain '../'