Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using CentOS 5.7 64-bit system and run Apache. Currently, I have a site has an .htaccess file contains thousands of "deny from IP" rules(added from cPanel). My server loading was very high recently, I suspect that those rules caused the problem. Will they?

I am thinking to move those rules to an iptables include file, but don't know how to setup. Any advice? Thank you.

Transfer the following

deny from 8.8.8.8

To

-A RH-Firewall-1-INPUT -i eth0 -s 8.8.8.8 -j DROP

Sar result

# sar -q

01:00:02 PM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
01:10:01 PM        41       359     42.59     39.85     26.52
01:20:11 PM        37       267     37.34     33.99     29.45
01:30:02 PM        19       242     24.99     30.76     30.85

# sar

01:00:02 PM       CPU     %user     %nice   %system   %iowait    %steal     %idle
01:10:01 PM       all     81.50      0.14     18.23      0.01      0.00      0.12
01:20:11 PM       all     78.41      0.00     16.96      0.01      0.00      4.62
01:30:02 PM       all     82.48      0.00     15.89      0.01      0.00      1.62
01:40:01 PM       all     84.48      0.01     15.05      0.00      0.00      0.46

Top result

top - 19:03:02 up  6:09,  1 user,  load average: 9.49, 15.19, 13.19
Tasks: 211 total,  34 running, 175 sleeping,   0 stopped,   2 zombie
Cpu(s): 77.2%us, 22.6%sy,  0.0%ni,  0.1%id,  0.0%wa,  0.0%hi,  0.2%si,  0.0%st
Mem:   4117724k total,  1678008k used,  2439716k free,    79456k buffers
Swap:  8385848k total,        0k used,  8385848k free,   780952k cached
share|improve this question
    
A large .htaccess file certainly isn't doing you any performance favors, but what makes you suspect that's the cause? –  Shane Madden Oct 13 '11 at 22:48
    
I am only guessing it's the .htaccess affect the performance. The CPU usage is always above 70%. I have a i5 CPU –  garconcn Oct 13 '11 at 22:59
    
You should probably verify that it's the source of the performance issues. Don't solve something that isn't the problem. –  Shane Madden Oct 14 '11 at 0:26
    
@shane, after move the deny rules from .htaccess to iptables using gac's method, the server load is not an issue anymore. –  garconcn Oct 14 '11 at 20:02

1 Answer 1

up vote 1 down vote accepted

I'm not so sure that what you're seeing is down to your deny rules, but here's a one liner which should help you transfer your rules (at least temporarily):

grep deny .htaccess | awk {'print $3;'} | while read i; do iptables -A RH-Firewall-1-INPUT -i eth0 -s ${i} -j DROP; done

Be warned that this will put the DROP rules directly on the end of your main INPUT chain, making them pretty difficult to unpick without just restarting iptables. If you want something easier to undo, then you should probably create an extra table first with something like:

iptables -A RH-Firewall-1-INPUT -j HTACCESS_TEST
grep deny .htaccess | awk {'print $3;'} | while read i; do iptables -A HTACCESS_TEST -i eth0 -s ${i} -j DROP; done

After this, you'll need to comment out your deny lines in .htaccess and possibly reload Apache to make it take effect.

share|improve this answer
    
Thanks. I was looking for your second solution. I got an error after run the first line. iptables v1.3.5: Couldn't load target `HTACCESS_TEST':/lib/iptables/libipt_HTACCESS_TEST.so: cannot open shared object file: No such file or directory –  garconcn Oct 13 '11 at 23:37
    
I got it. Thank you. –  garconcn Oct 14 '11 at 0:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.