1

For the last few days, I've been suffering from what appears to be a (presumably inadvertent) DDOS attack. I've been getting so many requests from an agent identifying as "Mozilla/4.0 (compatible; ICS)" that apache eats through all the available memory.

Consequently, I'd like to block all requests accompanied by this user agent, so I tried doing this in httpd.conf:

SetEnvIfNoCase User-Agent "Mozilla/4.0 (compatible; ICS)" bad_user
Deny from env=bad_user

But when I restart apache it complains about using deny here. Without having to wrap it in a location or directory block, which would mean I'd have to add a new block for each site, is there any way I can deny access to the whole server?


UPDATE: The error I get

  • Restarting web server apache2
    Syntax error on line 4 of /etc/apache2/httpd.conf: deny not allowed here [fail]
3
  • i think this question is better suited on serverfault.com?
    – David K.
    Apr 8, 2013 at 15:09
  • @DKOATED You might be right actually. Should I cross post or ask the mods to migrate it?
    – Tom Wright
    Apr 9, 2013 at 23:33
  • Closed because posted here: serverfault.com/questions/499327/… Apr 18, 2013 at 16:28

2 Answers 2

1

Generally, I think its bad practice to deny access based on the user agent, as it could really be spoofed to anything. You also could potentially block legitimate users access.

That being said, based on the apache docs, it appears you are using the correct syntax (http://httpd.apache.org/docs/2.2/howto/access.html)

What exactly is apache complaining about with the deny statement?

Before your deny statement try adding:

Order allow,deny Allow from all

3
  • Agree that usually bad practice to block by UA, but I think this is an unusual set of conditions - the log entries suggest that someone has just misconfigured a crawler.
    – Tom Wright
    Apr 9, 2013 at 23:27
  • I understand. I see you edited your question with the Apache error. Did you try adding the the "Order allow, deny" and "Allow from all" before your deny statement?
    – Badams
    Apr 10, 2013 at 3:20
  • When I do that, the error message just changes to be about "Order".
    – Tom Wright
    Apr 11, 2013 at 17:08
1

You can use the Directory directive with / as the path to apply to all folders for all sites.

example:

<Directory />
  SetEnvIfNoCase User-Agent "Mozilla/4.0 (compatible; ICS)" bad_user
  Deny from env=bad_user
</Directory>

You might already have a Deny from All at this level for security reasons. So, migrate it up through your directory tree until you reach a level that includes all of your sites.

4
  • That stops the error, but when I use user agent switcher for Firefox it doesn't seem to return a 403.
    – Tom Wright
    Apr 11, 2013 at 17:05
  • Maybe you have an 'Allow from All' at a higher level that overrides this?
    – Octopus
    Apr 11, 2013 at 19:04
  • I'm putting this in httpd.conf - is there a higher level than this?
    – Tom Wright
    Apr 12, 2013 at 9:49
  • I mean, choose a higher level directory. If you have a setting at /path any defs at /path/higher will override it.
    – Octopus
    Apr 12, 2013 at 15:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.