Move mass htaccess deny rules to iptables

Question

I am using CentOS 5.7 64-bit system and run Apache. Currently, I have a site has an .htaccess file contains thousands of "deny from IP" rules(added from cPanel). My server loading was very high recently, I suspect that those rules caused the problem. Will they?

I am thinking to move those rules to an iptables include file, but don't know how to setup. Any advice? Thank you.

Transfer the following

deny from 8.8.8.8

To

-A RH-Firewall-1-INPUT -i eth0 -s 8.8.8.8 -j DROP

Sar result

# sar -q

01:00:02 PM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
01:10:01 PM        41       359     42.59     39.85     26.52
01:20:11 PM        37       267     37.34     33.99     29.45
01:30:02 PM        19       242     24.99     30.76     30.85

# sar

01:00:02 PM       CPU     %user     %nice   %system   %iowait    %steal     %idle
01:10:01 PM       all     81.50      0.14     18.23      0.01      0.00      0.12
01:20:11 PM       all     78.41      0.00     16.96      0.01      0.00      4.62
01:30:02 PM       all     82.48      0.00     15.89      0.01      0.00      1.62
01:40:01 PM       all     84.48      0.01     15.05      0.00      0.00      0.46

Top result

top - 19:03:02 up  6:09,  1 user,  load average: 9.49, 15.19, 13.19
Tasks: 211 total,  34 running, 175 sleeping,   0 stopped,   2 zombie
Cpu(s): 77.2%us, 22.6%sy,  0.0%ni,  0.1%id,  0.0%wa,  0.0%hi,  0.2%si,  0.0%st
Mem:   4117724k total,  1678008k used,  2439716k free,    79456k buffers
Swap:  8385848k total,        0k used,  8385848k free,   780952k cached

Answer 1

I'm not so sure that what you're seeing is down to your deny rules, but here's a one liner which should help you transfer your rules (at least temporarily):

grep deny .htaccess | awk {'print $3;'} | while read i; do iptables -A RH-Firewall-1-INPUT -i eth0 -s ${i} -j DROP; done

Be warned that this will put the DROP rules directly on the end of your main INPUT chain, making them pretty difficult to unpick without just restarting iptables. If you want something easier to undo, then you should probably create an extra table first with something like:

iptables -A RH-Firewall-1-INPUT -j HTACCESS_TEST
grep deny .htaccess | awk {'print $3;'} | while read i; do iptables -A HTACCESS_TEST -i eth0 -s ${i} -j DROP; done

After this, you'll need to comment out your deny lines in .htaccess and possibly reload Apache to make it take effect.