Forum Moderators: phranque

Message Too Old, No Replies

deny access from specific useragents? possible?

         

jake66

9:00 pm on May 6, 2006 (gmt 0)

10+ Year Member



i've tried to incorporate a useragent ban via the script i'm using on my site, but it doesn't seem to work for bots (though it does for me, if i spoof my useragent)

the following agents seem to continuously get around the bans:
java/1.4.1_04
java/1.5.0_06
wget/1.9+cvs-stable (red hat modified)

carfac

1:38 am on May 7, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Jake:

I do it all the time.

Grab the script I have posted in this post:

[webmasterworld.com...]

The bad IP script that writes to an .htaccess file. Mod the code just a bit, so it looks at UA instead of IP, and instead of pointing to an .htaccess file, point it to a "bad_ua.txt" file. Fill that file up with all the bad UA's, and you are good to go!

Note that you will not need the trap.pl file to write to the file bad_ua.txt...

dave

BananaFish

10:30 am on May 7, 2006 (gmt 0)

10+ Year Member



You can use browsermatch:

BrowserMatchNoCase ^wget banme
BrowserMatchNoCase ^java banme
<directory mydocumentroot>
Order Deny,Allow
Deny from env=banme
</directory>

jake66

6:24 am on May 11, 2006 (gmt 0)

10+ Year Member



carfac, thanks for the response but that post is entirely over my head.. i'm new to htaccess and don't have root access so i'm not sure if i can do what you did?

BananaFish, can this code be used as-is?

jdMorgan

12:41 pm on May 11, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



jake66,

That code looks to be usable as-is, but I didn't research it or test it... That's your job. :)

A general recommendation for code posted here or on any forum: If you don't understand it thoroughly, then look up each directive [httpd.apache.org] and do a "sanity check" on the syntax and the value of the variables in the posted code. This will also expand your knowledge of Apache directives over time, so you don't have to wonder if the code's any good when you see it.

.htaccess, like http.conf, and conf.d are server configuration files. You should fully understand the operation and effect of any code you add to any of those files.

For more information, see the documents cited in our forum charter [webmasterworld.com] and the tutorials in the Apache forum section of the WebmasterWorld library [webmasterworld.com].

Jim