How to block IP Address?

Couldn't find this on another thread...

[stu2]

What is the best way to block an IP address from accessing my site?

[Romeo]

Hi Stu2,

the 'best' way is a DROP rule in the iptables firewall, which will keep that IP address away from any services on your box.

Another possobility is a
deny from 10.22.33.44
rule in your .htaccess file to keep away that IP address from your http services.

Regards,
R.

[stu2]

>the 'best' way is a DROP rule in the iptables firewall, which will keep that IP address away from any services on your box.<

Sorry. I'm on a shared host. I don't think I can do that.

>Another possobility is a
deny from 10.22.33.44
rule in your .htaccess file to keep away that IP address from your http services.<

Can I just use "Deny from IP Address" on 1 line, or do I need to wrap it like so...

order allow,deny
deny from IP Address
allow from all

Are they the same?

[Romeo]

It should work stand-alone in .htaccess, but it may be better to state explicitly the default access state and the order in which Allow and Deny are evaluated.

Here is the official docu:
[httpd.apache.org...]

Regards,
R.

[Wizcrafts]

Stu2 wrote:

order allow,deny
deny from IP Address
allow from all

Stu2;
You have the order-order backwards. It should be:

order deny,allow
deny from IP Address
allow from all

In fact, using this order negates the necessity for the "allow from all" directive, but some leave it in just in case.

You can expand on this and stack in a list of unwanted IP addresses, after the "deny from" directive, including partial addresses ending with a period (aaa.bbb.), or CIDR ranges (aaa.bbb.ccc.0/24). Just separate each one with a space, and have no carriage retur until the end of the list. The entire deny from should occupy one line only, with word wrap only used for visual purposes. You can stack multiple deny from single line lists under each other, using carriage returns after the last chacter on each line.
Ex:

<Files *>
order deny,allow
deny from aaa.bbb.ccc.ddd eee.fff.ggg. hhh.iii.j. kkl.mno.p.0/24 badisp.net 
</Files>

The Files tag may be optional, but I use it anyway. My folders are already protected against browsing.

Wiz

[stu2]

"It should work stand-alone in .htaccess,"

OK. Thanks. I prefer simplicity wherever possible.

"but it may be better to state explicitly the default access state and the order in which Allow and Deny are evaluated."

Why? Surely the default is already set to "Allow from all"?

Here is the official docu:

I've never really 100% *any* of the Apache docs I've ever read :( but it seems to me (from reading it) that I don't need the order/allow/deny stuff. "Deny from IP Address" seems to be suffice.

[stu2]

"You have the order-order backwards. It should be:

order deny,allow
deny from IP Address
allow from all"

Just goes to show how useful my web hosts help is. That was what they gave me :(

"The Files tag may be optional, but I use it anyway. My folders are already protected against browsing."

Does the Files tag alter anything? How have you protected your folders?

[Wizcrafts]

Stu2 asked Wiz;

Does the Files tag alter anything? How have you protected your folders?

The Files tag controls the reading of the specified files.
The example I used is this:

<Files *>
order deny,allow
deny from abc.def.ghi.jkl
</Files>

The * indicates ALL, therefore my statement says "regarding ALL files on the server, deny access to the "deny from" list, but allow access to all others not listed"

In my own .htaccess I have added this directive as well:

<Files .htaccess>
deny from all
</Files>

Can you guess what this means?

If you guessed that nobody but the person who is logged onto the FTP account with proper credentials can view your .htaccess file, you guessed correctly. Without this specific directive in place anybody who is not specifically denied access by your deny list, or some other rule, can view the contents of your .htaccess file via their browser. The above rule denies access to EVERYONE, except the OWNER of the file, which happens to be the person with the login credentials to the web server account.

If you have access rules you want to conceal from hackers, harvesters and content thieves, protect your .htaccess file with the rule I showed you. You can use the Files directive to deny access, or allow access to specific file types, or invidual files, to specific users or IP addresses.

Q: How have you protected your folders?
A #1: My folders contain files, which are denied to anybody on my deny from list.
A #2: I have a rule in my .htaccess forbidding the browsing of directories. It states that unless there is an index file (of the types specified), or they know the name of a file in a directory, they are not allowed to view the contents directories.

How do I deny browsing directories in .htaccess?

DirectoryIndex index.html index.htm index.shtml index.php /noread.html

The file noread.html tells the visitor that I don't allow browsing of unindexed directories and has links to my home page and sitemap.

I hope this helps

Wiz

[stu2]

>>Does the Files tag alter anything?

The Files tag controls the reading of the specified files. The example I used is this:

<Files *>
order deny,allow
deny from abc.def.ghi.jkl
</Files>

The * indicates ALL, therefore my statement says "regarding ALL files on the server, deny access to the "deny from" list, but allow access to all others not listed"<<

My question really was... does using your example change the meaning from a simple 1 line "Deny from IP Address"? Or, are they identical?

>>In my own .htaccess I have added this directive as well:

<Files .htaccess>
deny from all
</Files>

Can you guess what this means?<<

Yep. Does this go before or after your <Files *> statement? Or, doesn't it matter?

>>How do I deny browsing directories in .htaccess?

DirectoryIndex index.html index.htm index.shtml index.php /noread.html

The file noread.html tells the visitor that I don't allow browsing of unindexed directories and has links to my home page and sitemap.<<

I understand what you are doing (technically) but I don't understand what you are doing (logically).

When does the page noread.html get displayed? Is it when a specific url is requested but not found? Surely, a custom 404 Error page handles that consequence?

What do you mean by "unindexed directories"? Directories on your server but not part of your site?

How do you browse directories (as opposed to reading pages) in a web-browser?

Forgive me, but I seem to be having a hard time to grasp the concept you are explaining.

Q: I see a lot of quotes enclosed in rectangular boxes. This separates out the quotes very nicely. How do you do that?