0

How can I block all access to a PHP file? File name is similar to sm6######.php where #### can be any random digit.

How can I do it using mod_sec?

2 Answers 2

6

This sounds like a suitable situation for the <FilesMatch > directive, no need for mod_security at all.

<FilesMatch sm6[0-9]+\.php>
  Order Allow,Deny
  Deny from all
</FilesMatch>

Of course, if you don't want anyone to access the file, why not delete it or move it out of the DocumentRoot ?

If you edit your question to include more about who shouldn't be able to access the file I'll update my answer to match.

4
  • Thank you very much sir. This is really very good alternative solution. but problem is that I am bound to use mod security and i can't go away from it.... :( so right now i need to know that how can i achieve my goal using mod security. also please can you tell me precisely that what is main purpose of mod security ... i read that it is used to control access to files. can you please elaborate it ... and tell me how block all access to a file like sm6######.php (the #'s can be random numbers, not letters), how would I do it? Your help is really appreciated. Thanks again sir.
    – Kashif
    Mar 23, 2012 at 9:22
  • 2
    You don't know what the purpose of mod_security is but you are bound to use it over a very simple solution for your problem? If you are not familiar with mod_security, you should not be responsible for administrating rule sets for it. If you are, you have bigger issues and need to make yourself very familiar with it before moving forward.
    – Doug
    Mar 23, 2012 at 10:03
  • 1
    I agree with you sir. but I think this is a way of learning. of course when we start something we don't know about it and thats why we try to learn it. so there is no harm to that i think. ( it doesn't mean i know nothing about it but jst wanted to make myself clear that whatever i am thinking is not worng) Now the reason, why i m looking for so complicated solution is, that I have to use mod secuirty further for some other tasks and thats why i m starting with a simple task.how can i do something difficult with mod_sec when i can't handle a simple thing with it? hope you understand my point.
    – Kashif
    Mar 23, 2012 at 10:38
  • modsecurity.org/documentation would be a better place to start. The basic documentation provides examples which would provide a solution to your question, and more importantly, teach you what mod_security actually is.
    – Doug
    Mar 23, 2012 at 11:00
4
SecRule REQUEST_LINE "@rx sm6[0-9]{1,}\.php" \
"phase:2,block,severity:2,msg:'Blocking access to sm6#.php files.'"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .