Re: [users@httpd] SetEnvIf and exceptions

2023-04-12 Thread Eric Covener
> > One other question - is there an order of processing the .htaccess in the > document root and the virtual host config? Are they both processed > together, or does one take precedence over the other? > If VirtualHost is the only enclosing scope, it is processed earlier so it has lower

Re: [users@httpd] SetEnvIf and exceptions

2023-04-12 Thread Dave Wreski
Hi, On 4/11/23 8:59 PM, Tatsuki Makino wrote: Dave Wreski wrote on 2023/04/12 01:39: In case I wasn't clear, simply removing the caret was not enough to make this work. The "Require env SOMENAME2" was enough to begin blocking every page on the site with a 403, not just the RSS feeds or the

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Tatsuki Makino
Dave Wreski wrote on 2023/04/12 01:39: > In case I wasn't clear, simply removing the caret was not enough to make this > work. The "Require env SOMENAME2" was enough to begin blocking every page on > the site with a 403, not just the RSS feeds or the bots, but every legitimate > request. > >

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Dave Wreski
Hi, SetEnvIf user-agent "(?i:TurnitinBot)" SOMENAME1 SetEnvIf Request_URI "^linuxsecurity_features\.*$" SOMENAME2 And let it meet all the requirements. Require all granted Require not env SOMENAME1 Require env SOMENAME2 This had the effect of

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Eric Covener
On Tue, Apr 11, 2023 at 10:49 AM Dave Wreski wrote: > Hi, > > SetEnvIf user-agent "(?i:TurnitinBot)" SOMENAME1 > SetEnvIf Request_URI "^linuxsecurity_features\.*$" SOMENAME2 > > And let it meet all the requirements. > > > Require all granted > Require not env SOMENAME1 > Require env

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Dave Wreski
Hi, SetEnvIf user-agent "(?i:TurnitinBot)" SOMENAME1 SetEnvIf Request_URI "^linuxsecurity_features\.*$" SOMENAME2 And let it meet all the requirements. Require all granted Require not env SOMENAME1 Require env SOMENAME2 This had the effect of blocking elements on every page (and

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Eric Covener
On Tue, Apr 11, 2023 at 9:29 AM Dave Wreski wrote: > > Hi, > > On 4/10/23 11:48 PM, Tatsuki Makino wrote: > > Dave Wreski wrote on 2023/04/11 10:54: > > SetEnvIf user-agent "(?i:TurnitinBot)" stayout=1 > SetEnvIf Request_URI "^linuxsecurity_features\.*$" !stayout > > I have done it in the past,

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Dave Wreski
Hi, On 4/10/23 11:48 PM, Tatsuki Makino wrote: Dave Wreski wrote on 2023/04/11 10:54: SetEnvIf user-agent "(?i:TurnitinBot)" stayout=1 SetEnvIf Request_URI "^linuxsecurity_features\.*$" !stayout I have done it in the past, too. It was like allowing another level of conditions to be attached

Re: [users@httpd] SetEnvIf and exceptions

2023-04-11 Thread Tatsuki Makino
Hello. Frank Gingras wrote on 2023/04/11 13:36: > The legacy authz directives from 2.2 will indeed cause issues when mixed > with Require (2.4). Do not mix them. Yes. Basically, they MUST NOT BE MIXED, but we should know how they behave when the mod_access_compat is loaded. I think it was like

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Frank Gingras
The legacy authz directives from 2.2 will indeed cause issues when mixed with Require (2.4). Do not mix them. On Mon, Apr 10, 2023 at 11:48 PM Tatsuki Makino wrote: > Dave Wreski wrote on 2023/04/11 10:54: > > SetEnvIf user-agent "(?i:TurnitinBot)" stayout=1 > > SetEnvIf Request_URI

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Tatsuki Makino
Dave Wreski wrote on 2023/04/11 10:54: > SetEnvIf user-agent "(?i:TurnitinBot)" stayout=1 > SetEnvIf Request_URI "^linuxsecurity_features\.*$" !stayout I have done it in the past, too. It was like allowing another level of conditions to be attached to Allow and Deny, depending on the condition

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Dave Wreski
Hi, I don't know what is troubling you... For now, don't use the combination of Order,Allow,Deny and Require* in configuration file that will be created in 202x. :) AllowDeny of ENV should be replaced by the following. Allow from env=X_FOOBAR -> Require env X_FOOBAR It can write more

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Tatsuki Makino
Hello. I don't know what is troubling you... For now, don't use the combination of Order,Allow,Deny and Require* in configuration file that will be created in 202x. :) AllowDeny of ENV should be replaced by the following. Allow from env=X_FOOBAR -> Require env X_FOOBAR It can write more

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Dave Wreski
Hi, On 4/10/23 10:51 AM, Eric Covener wrote: .htaccess: negative Require directive has no effect in directive Ah, I guess you'll have to restore the RequireAll and its contents. Yes, I should have mentioned that I've already done that - without it, it was producing a 500 error for

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Eric Covener
> > .htaccess: negative Require directive has no effect in > directive > Ah, I guess you'll have to restore the RequireAll and its contents.

Re: [users@httpd] SetEnvIf and exceptions

2023-04-10 Thread Dave Wreski
Hi, I have an apache-2.4.56 install on fedora37 and trying to block some bots from accessing the site, unless they're trying to access our RSS feeds. How can I do this? I'm blocking the bots with SetEnvIF lines in the .htacess file in the document root like:    

Re: [users@httpd] SetEnvIf and exceptions

2023-04-08 Thread Tuk tuk kampot Services
trahie...@gmail.com Tuk tuk kampot drivers On Sun, Apr 9, 2023, 1:24 AM Eric Covener wrote: > > > On Sat, Apr 8, 2023 at 2:14 PM Dave Wreski > wrote: > >> Hi, >> >> I have an apache-2.4.56 install on fedora37 and trying to block some bots >> from accessing the site, unless they're trying to

Re: [users@httpd] SetEnvIf and exceptions

2023-04-08 Thread Eric Covener
On Sat, Apr 8, 2023 at 2:14 PM Dave Wreski wrote: > Hi, > > I have an apache-2.4.56 install on fedora37 and trying to block some bots > from accessing the site, unless they're trying to access our RSS feeds. How > can I do this? > > I'm blocking the bots with SetEnvIF lines in the .htacess file

[users@httpd] SetEnvIf and exceptions

2023-04-08 Thread Dave Wreski
Hi, I have an apache-2.4.56 install on fedora37 and trying to block some bots from accessing the site, unless they're trying to access our RSS feeds. How can I do this? I'm blocking the bots with SetEnvIF lines in the .htacess file in the document root like:     SetEnvIf user-agent