Forum Moderators: phranque
RewriteRule bin/ - [NC,F]
RewriteRule formmail\.(pl¦cgi)$ - [NC,F]
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/Mail.cgi h*tp/1.0" 404 210 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/mail.pl h*tp/1.0" 404 209 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/formmail.cgi h*tp/1.0" 404 214 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/FormMail.cgi h*tp/1.0" 404 214 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/Mail.pl h*tp/1.0" 404 209 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/formmail.pl h*tp/1.0" 404 213 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/mail.cgi h*tp/1.0" 404 210 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/FormMail.pl h*tp/1.0" 404 213 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/formmail2.pl h*tp/1.0" 404 214 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/FormMail2.pl h*tp/1.0" 404 214 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/formmail2.cgi h*tp/1.0" 404 215 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/FormMail2.cgi h*tp/1.0" 404 215 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:32 -0800] "POST /cgi-bin/mail2.pl h*tp/1.0" 404 210 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:33 -0800] "POST /cgi-bin/Mail2.cgi h*tp/1.0" 404 211 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:33 -0800] "POST /cgi-bin/mail2.cgi h*tp/1.0" 404 211 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
207.203.156.105 - - [22/Jan/2004:03:52:33 -0800] "POST /cgi-bin/Mail2.pl h*tp/1.0" 404 210 "h*tp://www.mydomain.com" "Mozilla/4.06 (Win95; I)"
>So why did these requests receive a 404
>instead of a 403? Thanks.
Two thoughts.
(1) Your rule is for bin/ and all attempts
that 404'd were for /cgi-bin/file.ext
(2) even if the /bin rule is equally
applicable to requests for
/cgi-bin/ then your second rule is to
rewrite formmail.(one of two extensions).
Many of the attempts were not named
formmail, but were instead named:
Mail, mail, formmail2, FormMail2, mail2,
Mail2, and the rule doesn't address
those varients
My opinion and a $1.25 will get you a cup of coffee, but that's what I first noticed.
1.) My understanding is that by leaving off a start anchor (^) anything that preceeds "bin/" is covered, and by leaving off an ending anchor ($), the rule also applies to anything following "bin/".
2.) For the files: formmail2, FormMail2 I guess I could include a wildcard allowance, but first at hand I'd like to find out why I'm seeing 404s instead of 403s.
I'm aware that some file names requested were for "mail" but I included them for possible aside discussions.
To test this, change your RewriteRule from bin/ to sys/ and see if requests for /cgi-sys/ generate a 403 or 404.
You might want to check the ...near perfect .htaccess (with edits) [webmasterworld.com] thread where this issue is being done to death.
;)
# What I use with my site
RewriteCond %{REQUEST_URI} ^/(cgi\-bin/¦cgi\-local/)\FormMail.(cgi¦php¦pl) [NC,OR]
RewriteCond %{REQUEST_URI} ^/(cgi\-bin/¦cgi\-local/)\FormMail [NC,OR]
or
RewriteCond %{REQUEST_URI} (mail.?form¦form¦form.?mail¦mail¦mailto)\.(cgi¦exe¦pl)$ [NC,OR]
There is nothing wrong with your existing rules in relation to the URL requests you posted. dcrombie probably has it right, though -- It is likely that these requests are being redirected (aliased) at a level above your .htaccess, and therefore your code can have no effect. Test by requesting formmail in a directory that does not contain "bin" and see if your rewriterule works - For the purposes of the test, it shouldn't matter if that directory exists or not - just see if your rule catches the "formmail" part.
Jim
Yup - my server forwards cgi-bin reguests through an alias.
Since no version of FormMail resides anywhere in my domain, and my cgi-bin resides 'above' my root level, I guess I don't need that code at all, just let the spammers get 404s.
Thanks.
