200 status for requests from IP not allowed by htaccess?

Question

I have a Debian 9 server which is continually beaten on by bots. I check the access logs for 200s every day just to be sure my countermeasures are working. The logs are full of 403 status requests with usually only a handful of 200s from allowed IPs. IP addresses edited below for privacy.

Doc root has the following htaccess file:

order deny,allow
deny from all
allow from  216.xx.xxx.xxx
allow from 184.xxx.xxx.xxx

AuthUserFile /var/www/.htpasswd
AuthName "Admin"
AuthType Basic

<Limit GET>
        require valid-user
</Limit>

On an ordinary day this command only yields accesses for the two IPs above and for ::1

sudo zcat /var/log/apache2/access.log.4.gz | awk '{ if($9 == 200) { print $1 " " $7  } }' | sort | uniq -c | sort -nr | head -10

But today we also had what appear to be two requests which got a 200 status despite not being in the htaccess as allowed.

::1 - - [17/Apr/2020:00:49:05 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.25 (Debian) OpenSSL/1.0.2r (internal dummy connection)"
103.231.90.xxx - - [17/Apr/2020:00:49:36 -0500] "OPTIONS * HTTP/1.1" 200 2670 "-" "Mozilla/5.0 [en] (X11, U; OpenVAS-VT 9.0.3)"
103.231.90.xxx - - [17/Apr/2020:00:49:39 -0500] "OPTIONS * HTTP/1.1" 200 163 "-" "Mozilla/5.0 [en] (X11, U; OpenVAS-VT 9.0.3)"
::1 - - [17/Apr/2020:00:49:52 -0500] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.25 (Debian) OpenSSL/1.0.2r (internal dummy connection)"

Do those represent successful accesses? If so, how do I correct my htaccess file so this is not possible? I thought it was already solid.

Answer 1

The OPTIONS * with a wildcard refers to the entire server, whereas the .htaccess file equals <Directory> configuration section. If you want to disallow these requests, you'd need to move your directives from .htaccess to <VirtualHost> or global server configuration.

BTW, Debian 9 comes with Apache 2.4, which has different access control directives from what you are using:

• Apache 2.2:

  order deny,allow 
  deny from all 
  allow from 216.xx.xxx.xxx 
  allow from 184.xxx.xxx.xxx
  

• Apache 2.4:

  Require ip 216.xx.xxx.xxx 184.xxx.xxx.xxx