htaccess not blocking

[Bruce Roy]

I recently had this entry in my access log:

Wed 19 Dec 2007 12:04:23 AM Family Group Sheet for Family http://hotaebywk.chat.ru/html/body? accessed by 82-44-240-252.cable.ubr01.haye.blueyonder.co.uk/82.44.240.252/.

My htaccess file has " deny from 82.44.*.* "

The full code is:

# allow all except those indicated here

<Limit GET POST PUT>

order allow,deny

allow from all

...

deny from 82.44.*.*

...

</Limit>

Is there a better way to block IP addresses? And does it always work?

Bruce Roy

[Luke]

I recently had this entry in my access log:

Wed 19 Dec 2007 12:04:23 AM Family Group Sheet for Family http://hotaebywk.chat.ru/html/body? accessed by 82-44-240-252.cable.ubr01.haye.blueyonder.co.uk/82.44.240.252/.

My htaccess file has " deny from 82.44.*.* "

The full code is:

# allow all except those indicated here

<Limit GET POST PUT>

order allow,deny

allow from all

...

deny from 82.44.*.*

...

</Limit>

Is there a better way to block IP addresses? And does it always work?

Bruce Roy

Hi Bruce,

That deny clause looks too msdos-ish

I think the proper format for deny is:

deny from 82.44.0.0/16

or:

deny from 82.44.0.0/255.255.0.0

These are equivalent in that they mask the first 16 bits (2 bytes) as being the thing you want to deny.

You were on the right track just too familiar with Windows methodology.

Let me know if this works better.

Luke

[Bruce Roy]

Hi Bruce,

That deny clause looks too msdos-ish

I think the proper format for deny is:

deny from 82.44.0.0/16

or:

deny from 82.44.0.0/255.255.0.0

These are equivalent in that they mask the first 16 bits (2 bytes) as being the thing you want to deny.

You were on the right track just too familiar with Windows methodology.

Let me know if this works better.

Luke

Thanks, Luke. I'll give that a go though I guess I won't know if it works until I get a similar breach.

Bruce

[arnold]

Bruce,

Your current problem is with the single IP Address 82.44.240.252.

I would begin by only denying that IP Address access to your website. Otherwise, you are blocking a great, great, great many others when you begin denying with 82.44.nnn.nnn.

You have to be concerned about denying many "innocent" users when you deny access too broadly.

Arnold

[brumer]

How to Specify Addresses

You can specify computer addresses in five ways:

Use the word all to refer to all computer addresses.

Use the complete domain name (e.g. dante.u.washington.edu) of an individual computer.

Use a partial domain name (e.g. washington.edu) to refer to all computers within a specific domain.

Use the complete IP address (e.g. 140.142.52.1) of an individual computer.

Use a partial IP address (e.g. 140.142) to refer to all computers within a specific subnet.

I ban all .RU addresses.......... too bad if the President of Russia wants a looksee.........!!

[Barbara]

Sorry for slightly hijacking this thread ....

Bruce - how do you ban a country, like you did with Russia?

What is the correct syntax to put into .htaccess?

Thanks in advance

[Rush]

This should block all .ru domains:

<Limit GET>

order deny,allow

deny from .ru

allow from all

</Limit>

On a side note, I block the useragent and that gets rid of almost all the hack attempts:

-----------------------------------------------------------------------------------

SetEnvIfNoCase User-Agent "indy library" keep_out

SetEnvIfNoCase User-Agent "Microsoft URL Control" keep_out

SetEnvIfNoCase User-Agent "libwww-perl" keep_out

SetEnvIfNoCase User-Agent "Mail.Ru" keep_out

order allow,deny

allow from all

deny from env=keep_out

-----------------------------------------------------------------------------------

Just thought I would throw that out there...

Rush