Browse Source

iQIzBAABCAAdFiEEOTuiJO0Wx/N4jCuQwkPDiFU+3l0FAlxrrVUACgkQwkPDiFU+
3l0oKQ/+MDwyLWAPNl3lBP5/ev5f4HMDa9w9NMVTZICZtVi/8gWc/Y0r7A1HUQXm
i+Eu7Wqhf8tIJo5CAQRDDv4OsSZTEcpyPAP7NWZWbX+NNZWUDWrxtPnvAiEAkFAv
H914n7G30BBVA4swkAu6guytdCiWlQYag/5S6zZzK0PJGTxHjN5kUxZWHhL9nGGe
w+49yRFD8Yh8WPivuO9yQ0M4As4tlGzaWl8w6tti8CqZ2gaWfiO6bJLMxvH9PK4h
UpOPZVOJqziS2LJeXXve4CNwVOpJ4EpaLi8rpC0rxUH5bHs35scnanBH7kvebp77
W4U7oZU52KNtS3+xVNnG4u4B7LLsxY5ulMrlA+FJPaGLIO9EjXm382C5xyh4hycB
38lKw7U/3MHMD+crPk3ZMqUz64pT6lwAhK/wOVWcTc4+ktnEB4JGs0bTFO9K6Y1n
lKk7+GAkFace0mGOni/BGbMLBYwKuSyzoA46cygmDKOAsIGBqQ7M5gVTXQIhJrbp
qn93Dp57BjULXh+3cG6HwpeYrPnCrjk9RxIVcb7Av/FfygeVULqTfvTb3tm4lRN8
WuYrpohi+hDmkWtu6XUTiEi4KFDaLC/zVVqshcSO16CauKp2vvekDnspZ6TxGTh6
gLnZPol+Rst0PL20LqYG5Th3MsL0EINyQ/9tYCM1ijEOCtQaMs0=
=r6UB
-----END PGP SIGNATURE-----

Fix Logic Error in blacklist-ips.conf and whitelist-ips.conf which breaks Apache 2.4 Security Logic

Mitchell Krog 6 years ago
parent
commit
e55733eae1
2 changed files with 39 additions and 14 deletions
  1. 30 11
      blacklist-ips.conf
  2. 9 3
      whitelist-ips.conf

+ 30 - 11
blacklist-ips.conf

@@ -165,19 +165,38 @@ Require not ip 93.238.202.44
 
 
 # Use this section at YOUR OWN RISK, you may block some legitimate networks but after many hours of
 # Use this section at YOUR OWN RISK, you may block some legitimate networks but after many hours of
 # Research this is now the completely updated list of all IP ranges IPV4 and IPV6 owned Qwest Communications
 # Research this is now the completely updated list of all IP ranges IPV4 and IPV6 owned Qwest Communications
-# PSINET and Cyveillance
+# PSINET and Cyveillance.
 
 
 # IMPORTANT NOTE: If you really want to keeps bot and things out of certain parts of your web site
 # IMPORTANT NOTE: If you really want to keeps bot and things out of certain parts of your web site
 # Rather implement a comlex Google Re-Captcha to reach sections of your sites and for people to be able
 # Rather implement a comlex Google Re-Captcha to reach sections of your sites and for people to be able
 # to access download links. Google Re-Captcha with images is too complex for any bot.
 # to access download links. Google Re-Captcha with images is too complex for any bot.
 
 
-Require ip 4.17.135.32/27
-Require ip 38.0.0.0/8
-Require ip 63.144.0.0/13
-Require ip 65.112.0.0/12
-Require ip 65.192.0.0/11
-Require ip 65.213.208.128/27
-Require ip 65.222.176.96/27
-Require ip 65.222.185.72/29
-Require ip 206.2.138.0/23
-Require ip 208.71.164.0/22
+# Only uncomment the lines below if you want to block these ranges otherwise rather just leave it as is.
+
+#Require not ip 4.17.135.32/27
+#Require not ip 38.0.0.0/8
+#Require not ip 63.144.0.0/13
+#Require not ip 65.112.0.0/12
+#Require not ip 65.192.0.0/11
+#Require not ip 65.213.208.128/27
+#Require not ip 65.222.176.96/27
+#Require not ip 65.222.185.72/29
+#Require not ip 206.2.138.0/23
+#Require not ip 208.71.164.0/22
+
+# BERKELEY SCANNER
+# ****************
+# The Berkeley University has a scanner testing all over the web sending a complex
+# payload an expecting a reply from servers who are infected or who just respond to such
+# a payload. The payload looks similar to this
+# "$\xC9\xE1\xDC\x9B+\x8F\x1C\xE71\x99\xA8\xDB6\x1E#\xBB\x19#Hx\xA7\xFD\x0F9-"
+# and is sometime VERY long. You may have noticed this in your logs.
+# I support research projects and all my servers respond with an error to this type of
+# string so I do not block them but if you want to block just uncomment the following line
+# or email them asking them not to scan your server. They do respond.
+# Visit http://169.229.3.91/ for more info
+
+# If you really do want to block them uncomment the line below.
+
+#Require not ip 169.229.3.91
+

+ 9 - 3
whitelist-ips.conf

@@ -12,9 +12,15 @@
 #                                                                            #
 #                                                                            #
 ##############################################################################
 ##############################################################################
 
 
-# BY DEFAULT ALL THE EXAMPLES BELOW ARE COMMENTED OUT AND HENCE NOT ENABLED
+# BY DEFAULT THE EXAMPLES BELOW ARE COMMENTED OUT AND HENCE NOT ENABLED
+# ADD ONLY ONE "Require ip" COMMAND PER LINE !
 
 
-	#Require ip 192.168.1.0 
+#Require ip 192.168.1.0 
+#Require ip 192.168.2.0 
 
 
 
 
-# DO NOT EVER USE 127.0.0.1 only real public facing IP addresses.
+
+# !!!!!! ********************************************************
+# DO NOT EVER USE 127.0.0.1 only real public facing IP addresses.
+# !!!!!! ********************************************************
+