Apache User Agent Whitelist

Only whitelisted UA's allowed... is this correct?

[JAB Creations]

Below is my attempt at creating an Apache user agent whitelist. Agents must be ADDED in order to be allowed to view the server versus on a blacklist agents can come whenever until they are blacklisted.

Here is my Apache user agent whitelist...

SetEnvIf User-Agent "Netscape" Netscape

<Files /error/error-403-ua.php>
order deny,allow
deny from all
</Files>

allow from env=Netscape

Obviously I am just using Netscape as an example.

This may be useful for people who wish to block out a good chunk of spammers for example.

KHTML, Gecko, MSIE, Opera, and W3C would be a good solid start to use for adding to the whitelist.

[JAB Creations]

Bump...

Does/should this work or not?

[jdMorgan]

No, it's not going to work. You have disallowed all access to your 403 error page, so any user-agent that is disallowed will get an initial 403 on the page they request, then another 403 trying to fetch the custom 403 error page (because the custom 403 page is denied), another 403 because of that, etc. It's a loop.

Then, your variable "Netscape" will only be set for Netscape, requiring you to use multiple variables and multiple "allow from" directives.

I'd recommend you look at the mod_setenvif [httpd.apache.org] and mod_access [httpd.apache.org] documentation again, modify your code, and test it. If you have trouble, ask about the specific problem you're having.

The construct I'd recommend is:

(mod_setenvif code)
If 403 error page requested, set variable "allowed"
If robots.txt page requested,, set variable "allowed"
If Netscape browser, set variable "allowed"
If Firefox browser, set variable "allowed", etc.

(mod_access code)
Order Deny,Allow
Deny from all
Allow from env=allowed

Jim

[JAB Creations]

Ok, a friend has lent me an O'Reilly book and I think I may be on to something...

Let's specify a list of browsers that STARTS with "Mozilla" and contains at least one of the other strings.

Lets work with Gecko browsers to start off and define those strings...

aol (mac)
camino
firefox
kmeleon
netscape
rv (mozilla suite when no other declaration is present though they could be nice and put suite instead of just rv)

These are (off the top of my head) known Gecko based browsers.

Now please tell me if this line is correct in ...
Agent starts with "Mozilla" and also contains one of the following strings...(as defined from above)...

BrowserMatch ^Mozilla regex env1=AOL env2=Camino env3=Firebird env4=Firefox env5=Meleon env6=Netscape env7=Phoenix env8=rv

[jdMorgan]

BrowserMatch ^Mozilla regex env1=AOL env2=Camino env3=Firebird env4=Firefox env5=Meleon env6=Netscape env7=Phoenix env8=rv

This line says, "If the user-agent starts with Mozilla, then set the variable called "regex" to "true", set the variable called "env1" to "AOL", set env2 to "Camino", set env3 to "Firebird", env4 to "Firefox", env5 to "Meleon", env6 to "Netscape", env7 to "Phoenix", and set env8 to "rv". I doubt that's what you want.

This will probably work better:

SetEnvIf Request-URI ^path-to-your-custom-403-page\.html$ allowed
SetEnvif Request-URI ^robots\.txt$ allowed
BrowserMatch ^Mozilla/[0-9.]{3,}.+(AOL¦Camino¦Phoenix¦Firebird¦Firefox¦Meleon¦Netscape¦rv:[0-9.]{3,}\)\ Gecko/) allowed
#
Order Deny,Allow
Deny from all
Allow from env=allowed

The BrowserMatch regex reads as follows: "Starts with 'Mozilla/' followed by at least three numbers and/or periods, followed by one or more unspecified characters, followed by one of ( 'AOL' or 'Camino' or 'Phoenix' or 'Firebird' or 'Firefox' or 'Meleon' or 'Netscape' or 'rv:' followed by at least three numbers and/or periods, followed by a right parenthese, a space, and 'Gecko/' )."

That last sub-pattern is a reasonably-tight filter for the Mozilla Suite (browser) user-agent.

You could also use the shorter

BrowserMatch ^Mozilla/[0-9.]{3,}.+rv:[0-9.]{3,}\)\ Gecko/ allowed

to match most or all of those Mozilla Gecko-based browsers.

Replace the broken pipe "¦" characters above with solid pipes from your keyboard - usually Shift-\ on U.S. 101-key keyboards; Posting on this board modifies the pipe character.

Jim

[JAB Creations]

I hate to post this but...

[Sat Aug 06 00:54:09 2005] [alert] [client 127.0.0.1] C:/MEDIA/INTERNET/Apache/xampp/htdocs/.htaccess: BrowserMatch regex could not be compiled.

I tried this live first (how much I trust your work along with a couple other specific people on here) and then tried it on a local server.

It requires regex? I'm not finding anything solid on regex in the book or from apache.org.