Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to use core - Apache HTTP Server's <LIMIT> Directive to limit spamers from doing POST's to my website(s):

<Limit POST>
        Order deny,allow
        Include /usr/local/apache2/conf/list.acl 
        Allow from all
</Limit>

and here is my list.acl

# cat /usr/local/apache2/conf/list.acl | tail -1
Deny from 222.0.0.0/8
# 

Yet, I'm getting 500s. Any ideas what am I doing wrong?

share|improve this question
    
(1) What does the Apache error log say? (2) It's hard to be sure what the cause is, because you've only shown us the last line of list.acl. –  Andrew Schulman Dec 17 '13 at 2:06
    
Is your configuration within a .htaccess file? If so, the Include directive isn't allowed there. –  Andrew Schulman Dec 17 '13 at 2:09
    
@AndrewSchulman error_log shows me 500 error, that's it( no more details .htaccess is empty other than <LIMIT> and list.acl contains big list of network ranges. –  alexus Dec 17 '13 at 2:13
    
so I moved this into main configuration file instead of .htaccess, yet while it doesn't produce error 500 anymore it still not limiting users from doing POSTs( any ideas? –  alexus Dec 20 '13 at 15:49

1 Answer 1

Read the description of Order Deny,Allow in the Apache docs:

Deny,Allow
First, all Deny directives are evaluated; if any match, the request is denied unless it also matches an Allow directive. Any requests which do not match any Allow or Deny directives are permitted.

So your Allow from all is overriding your Deny directives.

I think you want to switch to Order Allow,Deny. If you read carefully the description of that in the Apache docs, you'll see that it's what you want instead.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.