I'm using SetEnvIf and Deny to block access to certain countries in my .htaccess.
But I need to exclude certain URLs from this blocking, and thus I'm setting another environment variable for those URLs.
How do I Deny based on a combination of variable 1 and variable 2 ?
SetEnvIf GEOIP_COUNTRY_CODE xx BlockedCountry
SetEnvIf Request_URI "^/important" NeverBlock
In pseudo code I want to do this now:
Deny from env=BlockedCountry && !NeverBlock
From Apache documentation :
Syntax: Deny from all|host|env=[!]env-variable
[host|env=[!]env-variable] ...
Which means you can combine conditions one after the other (there is no "boolean" operators in between).
So in your case, it should look like this
Deny from env=BlockedCountry env=!NeverBlock
Update
From what you said, it looks like this implies an OR condition instead of an AND (what you want). To do so, you can use this workaround
SetEnvIf GEOIP_COUNTRY_CODE xx MustBeBlocked
SetEnvIf Request_URI "^/important" !MustBeBlocked
Deny from env=MustBeBlocked
With this technique, you set/unset the environment variable depending on the case, which simulates an AND condition.
Via htaccess, I would like to:
1 - Disallow everyone to access the site.
2 - Allow only 3 ips to pass through the ip ban.
3 - Leave 1 directory accessible fully to the public.
I understand the the rule number 3 goes against rule number 1, and this is where I am confused.
Currently I have this code:
<Files 403.shtml>
order deny,allow
deny from all
</Files>
allow from xxx.xxx.xxx.xx #Fred
allow from xxx.xxx.xxx.xxx #Ben
The above code works fine in not letting anyone in apart from my 3 coworkers.
<Directory /printing/>
Order Allow, Deny
Allow from All
</Directory>
The above code (when added) give me a 500 internal server error.
How to have a mix of both code so people can still access my directory publicly while blocking access to any other parts of the website?
You can't add a <Directory> container inside an htaccess file, since htaccess is already per-directory.
What you need to do is create an htaccess file in the printing directory with just:
Order Allow, Deny
Allow from All
We have enabled spelling mod by default on our server to avoid linking problems with html code done on Windows. Recently we added protection to our image folder to allow only images and documents of certain type to be accesible through htaccess by simple deny,allow and list of allowed types:
Order deny,allow
Deny from all
<Files ~ ".(jpe?g|png|gif|pdf)$">
Allow from all
</Files>
Problem is, that now images with wrong case in url, which are supposed to be corrected with mod-spelling, shows error (Forbidden access) instead of actual image. Any ideas how to correct this?
i have create custom form for user to submit the documents. now i want to restrict the access of that folder for others.. only specific ip can view the documents only.
for example: docs folder contains some images, pdf, and docx files. now i am restricting access for pdf and docx file using .htaccess code .
now as i have restrict the file access directly , the browser is returning 403 error.
now what i need is only my ip can access the pdf and docx.
for example: my ip is 100.100.100.100 so only i can access the pdf and docx file directly not others.
is there .htaccess code to allow file access for specific ip?
i did try this code.. which block access for my ip as well
Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from 100.100.100.100
</Files>
order deny,allow
deny from all
allow from 111.222.333.444
You need first to deny the content from all and then allow from custom IP. See more here: http://httpd.apache.org/docs/2.2/howto/access.html
I would like to allow only one country access, but exclude proxies within this country.
This is what I have (shortened version for convenience)
<Limit GET POST>
order deny,allow
deny from all
allow from 139.82.0.0/16
allow from 143.54.0.0/16
allow from 186.192.0.0/11
allow from 186.224.0.0/11
.
deny from 186.201.27.66
deny from 186.201.196.1
deny from 186.214.51.231
deny from 186.237.225.26
</Limit>
But I know this wont work. How do I go about doing this?
Update : for the new apache 2.4 jump directly to the end.
The Order keyword and its relation with Deny and Allow Directives is a real nightmare. It would be quite interesting to understand how we ended up with such solution, a non-intuitive one to say the least.
The first important point is that the Order keyword will have a big impact on how Allow and Deny directives are used.
Secondly, Deny and Allow directives are not applied in the order they are written, they must be seen as two distinct blocks (one the for Deny directives, one for Allow).
Thirdly, they are drastically not like firewall rules: all rules are applied, the process is not stopping at the first match.
You have two main modes:
The Order-Deny-Allow-mode, or Allow-anyone-except-this-list-or-maybe-not
Order Deny,Allow
This is an allow by default mode. You optionally specify Deny rules.
Firstly, the Deny rules reject some requests.
If someone gets rejected you can get them back with an Allow.
I would rephrase it as:
Rule Deny
list of Deny rules
Except
list of Allow rules
Policy Allow (when no rule fired)
The Order-Allow-Deny-mode, or Reject-everyone-except-this-list-or-maybe-not
Order Allow,Deny
This is a deny by default mode. So you usually specify Allow rules.
Firstly, someone's request must match at least one Allow rule.
If someone matched an Allow, you can still reject them with a Deny.
In the simplified form:
Rule Allow
list of Allow rules
Except
list of Deny rules
Policy Deny (when no rule fired)
Back to your case
You need to allow a list of networks which are the country networks. And in this country you want to exclude some proxies' IP addresses.
You have taken the allow-anyone-except-this-list-or-maybe-not mode, so by default anyone can access your server, except proxies' IPs listed in the Deny list, but if they get rejected you still allow the country networks. That's too broad. Not good.
By inverting to order allow,deny you will be in the reject-everyone-except-this-list-or-maybe-not mode.
So you will reject access to everyone but allow the country networks and then you will reject the proxies. And of course you must remove the Deny from all as stated by #Gerben and #Michael Slade (this answer only explains what they wrote).
The Deny from all is usually seen with order deny,allow to remove the allow by default access and make a simple, readable configuration. For example, specify a list of allowed IPs after that. You don't need that rule and your question is a perfect case of a 3-way access mode (default policy, exceptions, exceptions to exceptions).
But the guys who designed these settings are certainly insane.
All this is deprecated with Apache 2.4
The whole authorization scheme has been refactored in Apache 2.4 with RequireAll, RequireAny and RequireNone directives. See for example this complex logic example.
So the old strange Order logic becomes a relic, and to quote the new documentation:
Controling how and in what order authorization will be applied has been a bit of a mystery in the past
Not answering OPs question directly, but for the people finding this question in search of clarity on what's the difference between allow,deny and deny,allow:
Read the comma as a "but".
allow but deny: whitelist with exceptions.
everything is denied, except items on the allow list, except items on the deny list
deny but allow: blacklist with exceptions.
everything is allowed, except items on the deny list, except items on the allow list
allow only one country access, but exclude proxies within this country
OP needed a whitelist with exceptions, therefore allow,deny instead of deny,allow
Just use order allow,deny instead and remove the deny from all line.
Change your code to
<Limit GET POST>
deny from all
allow from 139.82.0.0/16
allow from 143.54.0.0/16
allow from 186.192.0.0/11
allow from 186.224.0.0/11
</Limit>
This way your htaccess will deny every except those that you explicitly allow with allow from..
A proxy within the allow range can easily be overwritten with an additional deny from.. rule.
As Gerben suggested, just change:
order deny,allow
deny from all
to
order allow,deny
And the restrictions will work as you want them to.
Details can be found in Apache's docs.
In apache2, linux configuration
Require all granted