Where to put an Allow/Deny in httpd.conf

Putting in a list of banned IP's

[carfac]

Hi Everyone!

I have a pretty good system of keeping the bad guys at bay, and I was trying to make it better. Currently, I use Apache:BlockAgent to block bad UA's, and I modified this into a second script to block bad IP's (which I naturally call Apache:BlockIP!)

I did this so I could have one master file of bad agents and IP's, and call the block from all my Virtual Hosts- makes for easy housekeeping. Typically, you get on the BlockIP list when you run a Spider-trap script on one of my sites. I usually just clear this file once a week or so, just in case any of the IP's are shared...

OK, so I have noticed a few IP's I want to keep off forever. So I decided to put something like this in httpd.conf:

<Directory "/">
order allow,deny
allow from all
## NAME PROTECT
deny from 12\.148\.209\.196
deny from 12\.224\.186\.194
deny from 12\.148\.196\.(12[8-9]¦1[3-9][0-9]¦2[0-4][0-9]¦25[0-5])
deny from 12\.148\.209\.(19[2-9]¦2[0-4][0-9]¦25[0-5])
deny from 62\.192\.125\.90
blah... blah... blah...
</Directory>

Now I have no way of testing this (except waiting!), and I am not sure I put this in the right place... so I thought I would ask...

1) Is this a good way of dealing with "permenant" offenders?
2) Is this the fastest/least strain on the server way to do this?
3) Is "<Directory "/">" correct, and where in httpd.conf should I put this if I want it to effect ALL VH's on ther server?

Thanks!

Dave

[Orange_XL]

The very best way to permantly ban offenders is through your firewall (kicking them of at the tcp-level is much more efficient as letting apache decide ot wont deal with them).

[carfac]

Orange_XL:

No firewall...

dave

[carfac]

Hi:

OK, I had a brilliant idea to test this.... I put my own IP in the list to deny. It was NOT denied, so whatever I am doing now does NOT work.

I put all my denies in a <Directory "/"></Directory> container in Section 2, outside any other containers. This is probably what is not working (although it validates in configtest!)

So I am not sure what sort of container I should put these in... any ideas?

Thanks!

dave

[carfac]

OK, I got it...

the <Directory "/"> is OK, and will apply to ALL VH's on a system if placed in Section 2, outside of any other containers...

The problem was escaping all the "."'s, as such: "255\.255\.255\.255"

When that is changed to "255.255.255.255", it all works! Oh, and I am currently unable to access my site via the web. I MUST fix that! :)

Dave

[Clark]

I've had a lot of problems with this allow deny in httpd.conf...I test it, it seems to work, I go about my business, then find out it shuts out everything. And hard to test and be 100% sure it works because the images are in your cache. Ouch!

I think you need a degree in httpd.conf