apache access DENY vs REQUIRE NOT IP

Post

Posted
Rating:
Item has a rating of 5 Item has a rating of 5 Item has a rating of 5 Item has a rating of 5 Item has a rating of 5 (Liked by Chris GrahamLiked by Adam Edington)
#5364 (In Topic #1092)
ironfeather

fix & infos

Hello,

right now the composr system works with the apache2 webserver but if you upgrade to apache2.4+ you will need to also use the "access_compat" module as some of apache language has changed.

I am using the "apache ultimate bad bot blocker"
https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker

I am using the new version of the bad bot blocker which uses the new apache language, and "access_compat" is not used…. so to fix…

copy /sources/failure.php to /sources_custom/failure.php

edit  /sources_custom/failure.php

find the function add_ip_ban around line 754 or so.
replace the 'deny '  with 'Require not ip '  in 4 locations.

find the  function remove_ip_ban
replace the 'deny '  with 'Require not ip '  in 2 locations.

edit your /.htaccess
towards the very bottom change so it looks something like this:

Code

<RequireAll>
Require all granted
# IP bans go here (leave this comment here! If this file is writeable, Composr will write in IP bans below, in sync with its own DB-based banning - this makes DOS/hack attack prevention stronger)
# Require not ip xxx.xx.x.x (leave this comment here!)
Require not ip 212.7.220.20

</RequireAll>

reload your website to make sure the .htaccess is OK
I have not tested the failure.php but assume that bit will work.

NOTE:  check other .htaccess files in other directories and update if needed

 

Post

Posted
Rating:
#5365
Chris Graham
Thanks, that was a big help. I had no idea that Apache had changed this, I guess having the compat module installed is extremely common. Especially important as Apache 2.2 is no longer maintained.

Fixed in https://github.com/ocproducts/composr/commit/579e45b8de93e1d7c6f3e702ee12e4c35a5bbb82

I don't love the fix I've done (duplicating the IP blocks unless people strip out the compat code from their .htaccess), but I don't think we can drop Apache 2.2 in v10. I'll make an issue for v11.
0 guests and 0 members have recently viewed this.