Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

For the last few days, I've been suffering from what appears to be a (presumably inadvertent) DDOS attack. I've been getting so many requests from an agent identifying as "Mozilla/4.0 (compatible; ICS)" that apache eats through all the available memory.

Consequently, I'd like to block all requests accompanied by this user agent, so I tried doing this in httpd.conf:

SetEnvIfNoCase User-Agent "Mozilla/4.0 (compatible; ICS)" bad_user
Deny from env=bad_user

But when I restart apache it complains about using deny here. Without having to wrap it in a location or directory block, which would mean I'd have to add a new block for each site, is there any way I can deny access to the whole server?


UPDATE: The error I get

  • Restarting web server apache2
    Syntax error on line 4 of /etc/apache2/httpd.conf: deny not allowed here [fail]
share|improve this question
    
i think this question is better suited on serverfault.com? –  DKOATED Apr 8 '13 at 15:09
    
@DKOATED You might be right actually. Should I cross post or ask the mods to migrate it? –  Tom Wright Apr 9 '13 at 23:33
    
Closed because posted here: serverfault.com/questions/499327/… –  paulmorriss Apr 18 '13 at 16:28
add comment

closed as off topic by Su', Stephen Ostermiller, paulmorriss Apr 18 '13 at 16:27

Questions on Webmasters Stack Exchange are expected to relate to webmastering within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

Generally, I think its bad practice to deny access based on the user agent, as it could really be spoofed to anything. You also could potentially block legitimate users access.

That being said, based on the apache docs, it appears you are using the correct syntax (http://httpd.apache.org/docs/2.2/howto/access.html)

What exactly is apache complaining about with the deny statement?

Before your deny statement try adding:

Order allow,deny Allow from all

share|improve this answer
    
Agree that usually bad practice to block by UA, but I think this is an unusual set of conditions - the log entries suggest that someone has just misconfigured a crawler. –  Tom Wright Apr 9 '13 at 23:27
    
I understand. I see you edited your question with the Apache error. Did you try adding the the "Order allow, deny" and "Allow from all" before your deny statement? –  Badams Apr 10 '13 at 3:20
    
When I do that, the error message just changes to be about "Order". –  Tom Wright Apr 11 '13 at 17:08
add comment

You can use the Directory directive with / as the path to apply to all folders for all sites.

example:

<Directory />
  SetEnvIfNoCase User-Agent "Mozilla/4.0 (compatible; ICS)" bad_user
  Deny from env=bad_user
</Directory>

You might already have a Deny from All at this level for security reasons. So, migrate it up through your directory tree until you reach a level that includes all of your sites.

share|improve this answer
    
That stops the error, but when I use user agent switcher for Firefox it doesn't seem to return a 403. –  Tom Wright Apr 11 '13 at 17:05
    
Maybe you have an 'Allow from All' at a higher level that overrides this? –  Octopus Apr 11 '13 at 19:04
    
I'm putting this in httpd.conf - is there a higher level than this? –  Tom Wright Apr 12 '13 at 9:49
    
I mean, choose a higher level directory. If you have a setting at /path any defs at /path/higher will override it. –  Octopus Apr 12 '13 at 15:41
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.