Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is the a way I can have Apache return a 500 status when it receives a request from a particular (malicious) user agent?

share|improve this question
    
Sure, just arrange for your application to crash when it receives such a request. You should consider returning a more reasonable error such as 403 instead. –  Michael Hampton Sep 26 '12 at 2:51
    
The point is to disuade malicious vulnerability scanning. The idea is to respond unreasonably, be it forbidden or server error (server error is preferable as it provides the impression the server isn't able to respond effectively). –  daaa Sep 26 '12 at 2:59
    
You dissuade vulnerability scanning by putting criminals in prison. You protect your web site by reading this. –  Michael Hampton Sep 26 '12 at 3:02
    
Sorry, but if you put a 500 error in front of a vulnerability scanner, whoever is running it is going to think your app is so badly written that it'll be easy to get in. You will attract unwanted attention. –  Michael Hampton Sep 26 '12 at 3:05
    
@daaa, you've got a reasonable answer now. You might do better editing the question to, "Can I have Apache return an arbitrary error code..."? –  pjmorse Oct 6 '12 at 10:38
add comment

1 Answer

Yes, you can do it with the mod_rewrite module. The following entry will return a 403 Forbidden response to clients with the text "Opera" or "MSIE" in their user agent strings regardless of text case.

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} MSIE [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Opera [NC]
RewriteRule ^.* - [F,L]

If you'd rather return 500 Internal Server Error change the F to R=500 at the end of the RewriteRule directive.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.