How to whitelist a directory in Apache configuration

Question

In Wordpress, one of the few effective ways at reducing server load is to whitelist individual clients to /wp-login.php and /wp-admin/:

<Directory /wp-admin>
    order deny,allow
    deny from all
    allow from 10.1.1.50
    allow from ...other ips...
</Directory>

But I don't want to have to edit and reload Apache to change this list. In my Virtual Host, I want:

<Directory /wp-admin>
     RewriteEngine On
     RewriteMap hosts-allow txt:/var/www/html/wp/wp-admin/hosts.allow
     RewriteCond ${hosts-allow:%{REMOTE_ADDR}|NOT-FOUND} =NOT-FOUND [AND]
     RewriteCond ${hosts-allow:%{REMOTE_HOST}|NOT-FOUND} =NOT-FOUND
     RewriteRule ^ - [F]
</Directory>

But:

[root@blah httpd]# service httpd reload                                                                                                                                                                     
Reloading httpd: not reloading due to configuration syntax error
                                                       [FAILED]
[root@blah httpd]# apachectl -S                                                                                                                                                                             
Syntax error on line 34 of /etc/httpd/sites-enabled/example.org.conf:
RewriteMap not allowed here

So is there a way to accomplish what this says that doesn't require RewriteMap or do I need to write a new module?

score 0 · Accepted Answer · answered Aug 18 '13 at 23:55

0

Create .htaccess file and put allowed IP addresses there. RewriteMap is not allowed within Directory.

answered Aug 18 '13 at 23:55

GioMac

4,444
3
24
41

Ok. This does require adding an `allowoverride` to the virtualhost config. But it would allow dynamic changes to the access list without reloading apache. – Nicholas Andre Aug 19 '13 at 12:48
Yes, this is only way for standard configuration. You can also use modsecurity and specify file in it's configuration, but it will be much complicated. – GioMac Aug 19 '13 at 12:51

Vladimir · Answer 2 · 2013-12-15T08:20:16.563

0

Try this:

    RewriteMap ipslist txt:/full/path/to/iplist.txt
    RewriteCond %{REMOTE_ADDR} ^(.*)$
    RewriteCond ${ipslist:%1|black} ^black$ [NC]
    RewriteRule (.*) - [F]

And your file should look something like this:

192.168.0.12 ok
127.0.0.1 ok
[...]

edited Dec 15 '13 at 08:20

answered Dec 11 '13 at 13:38

Vladimir

321
1
12

How to whitelist a directory in Apache configuration

2 Answers2