3

I have a bunch of files that are secure_xxxxxx.php. Is there a way to use .htaccess to block access to all the secure_* php files based on IP?

EDIT: I've tried but I get 500 errors

<FilesMatch "^secure_.*\.php$">
order deny all
deny from all
allow from my ip here
</FilesMatch>

Don't see any errors in apache error logs either

httpd -M
Loaded Modules:
 core_module (static)
 authn_file_module (static)
 authn_default_module (static)
 authz_host_module (static)
 authz_groupfile_module (static)
 authz_user_module (static)
 authz_default_module (static)
 auth_basic_module (static)
 include_module (static)
 filter_module (static)
 log_config_module (static)
 logio_module (static)
 env_module (static)
 expires_module (static)
 headers_module (static)
 setenvif_module (static)
 version_module (static)
 proxy_module (static)
 proxy_connect_module (static)
 proxy_ftp_module (static)
 proxy_http_module (static)
 proxy_scgi_module (static)
 proxy_ajp_module (static)
 proxy_balancer_module (static)
 ssl_module (static)
 mpm_prefork_module (static)
 http_module (static)
 mime_module (static)
 dav_module (static)
 status_module (static)
 autoindex_module (static)
 asis_module (static)
 info_module (static)
 suexec_module (static)
 cgi_module (static)
 dav_fs_module (static)
 negotiation_module (static)
 dir_module (static)
 actions_module (static)
 userdir_module (static)
 alias_module (static)
 rewrite_module (static)
 so_module (static)
 fastinclude_module (shared)
 auth_passthrough_module (shared)
 bwlimited_module (shared)
 frontpage_module (shared)
 suphp_module (shared)
Syntax OK

Files seem to work fine.

2
  • yes, you can at least make a rewrite rule based on ip.
    – user130370
    Oct 25, 2012 at 16:40
  • Any examples? So far I've had 500 errors. Oct 25, 2012 at 19:25

2 Answers 2

3

You should be able to use the Files directive and mod_authz_host to achieve you goals.

For example:

<Files "secure_*.php">
    Require 192.168.0.0/24
</Files>

See the references below.

http://httpd.apache.org/docs/current/mod/core.html#files http://httpd.apache.org/docs/current/howto/access.html

Or using FilesMatch and the older ACL syntax:

<FilesMatch "^secure_.*\.php$">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</FilesMatch>

This should only allow access from localhost.

7
  • Does it require PHP to be a certain mode? I got a 500 error with it Oct 25, 2012 at 19:24
  • FilesMatch is what I would want to use maybe? Oct 25, 2012 at 19:30
  • FilesMatch works, too. It's necessary if you want to use regular experessions in your match. PHP shouldn't be an issue here. If you are using an older version of Apache, you may need to use "allow" and "deny" instead of require. Check your Apache error log for more info.
    – slaptijack
    Oct 25, 2012 at 19:34
  • Yea, I was using allow/deny but still 500'd on me. Appache is 2.2.23 Oct 25, 2012 at 19:37
  • I recommend updating your original question with the content of your .htaccess file and any relevant error messages from Apache's error log.
    – slaptijack
    Oct 25, 2012 at 19:51
1

Yes, I think it's possible by using regular expression in .htaccess http://expressionengine.com/wiki/Regular_Expressions_in_.htaccess

and also limitation based on IPs using allow and deny options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .