Putting IP blocking in a separate conf file

Fliggerty · 01-01-2010, 12:57 AM

Hello,

Running Red Hat (not sure of the build atm) and I need to be able to put all of the IP blocking in a separate file. It will eventually be uploaded to a large number of hosting accounts, and modified from time to time...so it isn't feasible to modify that many httpd.conf files each time we need to add an IP to be blocked.

In httpd.conf I can add the "Deny from" line to the following directive and blocks it just fine:

Code:

<Directory "/var/www/html">

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
#   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important.  Please see
# http://httpd.apache.org/docs-2.0/mod/core.html#options
# for more information.
#
    Options FollowSymLinks MultiViews Includes
    AddHandler cgi-script .cgi .pl .py .sh

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
#   Options FileInfo AuthConfig Limit
#
    AllowOverride All

#
# Controls who can get stuff from this server.
#
    Order allow,deny
    Allow from all
    Deny from 123.456.789.098
</Directory>

There is an include to pick up all *conf files in ../conf.d, and everything else in there is working just fine. I created a file called robots.conf; it currently has a set of mod_rewrite rules which work. So I added this to that file:

Code:

<Directory "/var/www/html">
	Order allow,deny
	Allow from all
	Deny from 123.456.789.098
</Directory>

It is not blocking access from the IP with it in there. I've done all of the usual things; restarted Apache, cleared browser cache etc. I can also block it using that same directive in a local .htaccess.

Any suggestions? TIA!

--Fligg

carltm · 01-01-2010, 08:17 AM

It sounds like your <Directory "/var/www/html"> definition is appearing
twice, once in the httpd.conf and again in the robots.conf. I'll bet
that apache is ignoring the second one.

Check your logs for error messages after restarting apache. It may
give a clue.

bathory · 01-01-2010, 08:46 AM

Hi,

What you can do, is to use .htaccess and the SetEvnIf directive. Put the following in .htaccess in the directory you want to protect:

Code:

Order Allow,Deny
Allow from all
Deny from env=block

SetEnvIf Remote_Addr 123.456.789.098 block
SetEnvIf Remote_Addr 111.222.333.444 block

And you can add more ips, running:
echo "SetEnvIf Remote_Addr x.x.x.x block" >> /path/to/docroot/.htaccess

BTW carltm is right, you cannot have 2 <Directory "/var/www/html"> definitions.

Regards