1

In Wordpress, one of the few effective ways at reducing server load is to whitelist individual clients to /wp-login.php and /wp-admin/:

<Directory /wp-admin>
    order deny,allow
    deny from all
    allow from 10.1.1.50
    allow from ...other ips...
</Directory>

But I don't want to have to edit and reload Apache to change this list. In my Virtual Host, I want:

<Directory /wp-admin>
     RewriteEngine On
     RewriteMap hosts-allow txt:/var/www/html/wp/wp-admin/hosts.allow
     RewriteCond ${hosts-allow:%{REMOTE_ADDR}|NOT-FOUND} =NOT-FOUND [AND]
     RewriteCond ${hosts-allow:%{REMOTE_HOST}|NOT-FOUND} =NOT-FOUND
     RewriteRule ^ - [F]
</Directory>

But:

[root@blah httpd]# service httpd reload                                                                                                                                                                     
Reloading httpd: not reloading due to configuration syntax error
                                                       [FAILED]
[root@blah httpd]# apachectl -S                                                                                                                                                                             
Syntax error on line 34 of /etc/httpd/sites-enabled/example.org.conf:
RewriteMap not allowed here

So is there a way to accomplish what this says that doesn't require RewriteMap or do I need to write a new module?

0

Create .htaccess file and put allowed IP addresses there. RewriteMap is not allowed within Directory.

2
  • Ok. This does require adding an allowoverride to the virtualhost config. But it would allow dynamic changes to the access list without reloading apache. Aug 19 '13 at 12:48
  • Yes, this is only way for standard configuration. You can also use modsecurity and specify file in it's configuration, but it will be much complicated.
    – GioMac
    Aug 19 '13 at 12:51
0

Try this:

    RewriteMap ipslist txt:/full/path/to/iplist.txt
    RewriteCond %{REMOTE_ADDR} ^(.*)$
    RewriteCond ${ipslist:%1|black} ^black$ [NC]
    RewriteRule (.*) - [F]

And your file should look something like this:

192.168.0.12 ok
127.0.0.1 ok
[...]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.