Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a bunch of files that are secure_xxxxxx.php. Is there a way to use .htaccess to block access to all the secure_* php files based on IP?

EDIT: I've tried but I get 500 errors

<FilesMatch "^secure_.*\.php$">
order deny all
deny from all
allow from my ip here
</FilesMatch>

Don't see any errors in apache error logs either

httpd -M
Loaded Modules:
 core_module (static)
 authn_file_module (static)
 authn_default_module (static)
 authz_host_module (static)
 authz_groupfile_module (static)
 authz_user_module (static)
 authz_default_module (static)
 auth_basic_module (static)
 include_module (static)
 filter_module (static)
 log_config_module (static)
 logio_module (static)
 env_module (static)
 expires_module (static)
 headers_module (static)
 setenvif_module (static)
 version_module (static)
 proxy_module (static)
 proxy_connect_module (static)
 proxy_ftp_module (static)
 proxy_http_module (static)
 proxy_scgi_module (static)
 proxy_ajp_module (static)
 proxy_balancer_module (static)
 ssl_module (static)
 mpm_prefork_module (static)
 http_module (static)
 mime_module (static)
 dav_module (static)
 status_module (static)
 autoindex_module (static)
 asis_module (static)
 info_module (static)
 suexec_module (static)
 cgi_module (static)
 dav_fs_module (static)
 negotiation_module (static)
 dir_module (static)
 actions_module (static)
 userdir_module (static)
 alias_module (static)
 rewrite_module (static)
 so_module (static)
 fastinclude_module (shared)
 auth_passthrough_module (shared)
 bwlimited_module (shared)
 frontpage_module (shared)
 suphp_module (shared)
Syntax OK

Files seem to work fine.

share|improve this question
    
yes, you can at least make a rewrite rule based on ip. –  coincoin Oct 25 '12 at 16:40
    
Any examples? So far I've had 500 errors. –  Tiffany Walker Oct 25 '12 at 19:25

2 Answers 2

up vote 2 down vote accepted

You should be able to use the Files directive and mod_authz_host to achieve you goals.

For example:

<Files "secure_*.php">
    Require 192.168.0.0/24
</Files>

See the references below.

http://httpd.apache.org/docs/current/mod/core.html#files http://httpd.apache.org/docs/current/howto/access.html

Or using FilesMatch and the older ACL syntax:

<FilesMatch "^secure_.*\.php$">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</FilesMatch>

This should only allow access from localhost.

share|improve this answer
    
Does it require PHP to be a certain mode? I got a 500 error with it –  Tiffany Walker Oct 25 '12 at 19:24
    
FilesMatch is what I would want to use maybe? –  Tiffany Walker Oct 25 '12 at 19:30
    
FilesMatch works, too. It's necessary if you want to use regular experessions in your match. PHP shouldn't be an issue here. If you are using an older version of Apache, you may need to use "allow" and "deny" instead of require. Check your Apache error log for more info. –  slaptijack Oct 25 '12 at 19:34
    
Yea, I was using allow/deny but still 500'd on me. Appache is 2.2.23 –  Tiffany Walker Oct 25 '12 at 19:37
    
I recommend updating your original question with the content of your .htaccess file and any relevant error messages from Apache's error log. –  slaptijack Oct 25 '12 at 19:51

Yes, I think it's possible by using regular expression in .htaccess http://expressionengine.com/wiki/Regular_Expressions_in_.htaccess

and also limitation based on IPs using allow and deny options.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.