For the last few days, I've been suffering from what appears to be a (presumably inadvertent) DDOS attack. I've been getting so many requests from an agent identifying as "Mozilla/4.0 (compatible; ICS)" that apache eats through all the available memory.

Consequently, I'd like to block all requests accompanied by this user agent, so I tried doing this in httpd.conf:

SetEnvIfNoCase User-Agent "Mozilla/4.0 (compatible; ICS)" bad_user
Deny from env=bad_user

But when I restart apache it complains about using deny here. Without having to wrap it in a location or directory block, which would mean I'd have to add a new block for each site, is there any way I can deny access to the whole server?

UPDATE: The error I get

  • Restarting web server apache2
    Syntax error on line 4 of /etc/apache2/httpd.conf: deny not allowed here [fail]

Generally, I think its bad practice to deny access based on the user agent, as it could really be spoofed to anything. You also could potentially block legitimate users access.

That being said, based on the apache docs, it appears you are using the correct syntax (http://httpd.apache.org/docs/2.2/howto/access.html)

What exactly is apache complaining about with the deny statement?

Before your deny statement try adding:

Order allow,deny Allow from all

  • Agree that usually bad practice to block by UA, but I think this is an unusual set of conditions - the log entries suggest that someone has just misconfigured a crawler. – Tom Wright Apr 9 '13 at 23:27
  • I understand. I see you edited your question with the Apache error. Did you try adding the the "Order allow, deny" and "Allow from all" before your deny statement? – Badams Apr 10 '13 at 3:20
  • When I do that, the error message just changes to be about "Order". – Tom Wright Apr 11 '13 at 17:08

You can use the Directory directive with / as the path to apply to all folders for all sites.


<Directory />
  SetEnvIfNoCase User-Agent "Mozilla/4.0 (compatible; ICS)" bad_user
  Deny from env=bad_user

You might already have a Deny from All at this level for security reasons. So, migrate it up through your directory tree until you reach a level that includes all of your sites.

  • That stops the error, but when I use user agent switcher for Firefox it doesn't seem to return a 403. – Tom Wright Apr 11 '13 at 17:05
  • Maybe you have an 'Allow from All' at a higher level that overrides this? – Octopus Apr 11 '13 at 19:04
  • I'm putting this in httpd.conf - is there a higher level than this? – Tom Wright Apr 12 '13 at 9:49
  • I mean, choose a higher level directory. If you have a setting at /path any defs at /path/higher will override it. – Octopus Apr 12 '13 at 15:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.