Support

Admin Tools

#14008 IIS | Web application Firewall -> Site IP Blacklist

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Tuesday, 06 November 2012 11:21 CST

joombler
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 2.5.7
PHP version: 5.4
MySQL version: 5.5
Host: (optional, but it helps us help you)
Admin Tools version: 2.5.7

Description of my issue:
Read some articles about Admin Tools and it now appears that it works with .htaccess too.
As my hosting provider uses IIS, there is no .htaccess file used... Does this affect the setup I made regarding black listed IP addresses? I noticed that, althought I blacklist an IP address, I still receive messages from Admin Tools, saying that this ip user had visited the site, together with this message:

--- cut ---

Wij willen u op de hoogte brengen dat een beveiligingsuitzondering is gedetecteerd op uw website Archipelschool De Leeuwenburch met de volgende gegevens:

IP Adres: 208.115.111.72
Reden: http://ip-lookup.net/index.php?ip=208.115.111.72

Als dit soort beveiligingsuitzonderingen zich blijft herhalen, log dan in op de back-end van uw website en voeg dit IP-adres toe in uw Admin Tools 'Web Applicatie Firewall' functie om de zich misdragende gebruiker volledig te blokkeren.

Met vriendelijke groet,
Het template= in URL team

--- cut ---

thanks,
Jos Chrispijn
[email protected]

Artificial intelligence is no match for natural ignorance...

nicholas
Akeeba Staff
Manager
Hi Jos,

Sadly, IIS has very limited URL redirection features with its web.config file. It can not be used to deliver the same effective protection as Apache with .htaccess files can. Even though this prevents you from having a paranoid security level, it doesn't adversely effect your site setup.

Regarding the email, I see that the Dutch translation is a little outdated. It should tell you that a security exception occurred from IP address 208.115.111.72 and the reason was "template= in URL" . This happens because you are using the feature of AT which blocks URLs with template= in their URL. Consult the documentation for more info on what that means.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

joombler
Hi,
Thanks for your reply. As there are more often hosting providers that provide J! under IIS, I think it will be very good for the Admin Tools to support iirf.ini.
As .htaccess it is a plain text file. What I now do to block attackers is this; I put the following text into the irrf.ini file

--- cut ---

#IP blocklist
RewriteCond %{REMOTE_ADDR} ^(1.2.3.4)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(78.178.186.41)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(78.178.186.41)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(95.108.151.244)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(208.115.113.88)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(178.154.243.116)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(95.108.150.235)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(208.115.111.72)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(109.120.157.179)(.*)$ [OR]
RewriteCond %{REMOTE_ADDR} ^(84.84.110.202)(.*)$
RewriteRule ^.*$ / [F]
--- cut ---

Would it be possible for only blocking ip's to add an extra option in the config in which one can choose for either .htaccess or .iirf.ini? You then only have to generate a RewriteCond line.
I will be happe to test it for you.

Will have a check on the outdated text and see if I can change it somewhere.

Thanks,
Jos Chrispijn
[email protected]

Artificial intelligence is no match for natural ignorance...

nicholas
Akeeba Staff
Manager
Please note that iirf.ini is ONLY used by a very specific third party product called Ionics ISAPI Rewrite Filter. It is not installed with IIS and it's not installed on most of the hosts using IIS. If I have to support something which costs a truckload of money to install and used by less that 0.1% of my users I will have to charge something exorbitant, like 2,000$ per year per site. Otherwise it doesn't make any economic sense for me to shove money and effort (=more money) into supporting something which is used by you and probably two or three more people. I hope you understand what I'm saying here. It's not a matter of "am I capable of doing this", it's a matter of "does it make economic sense for me to do this".

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

joombler
Makes sense; I wouldn't either if I were you.
I will develop a script myself that is triggered from within my mailclient (Thunderbird) on email containing alerts coming from AdminTools. It will filter the ip address from it and put it into iirf.ini. Should be very easy for a nub like me :-)
Thanks,
Joombler

Artificial intelligence is no match for natural ignorance...

nicholas
Akeeba Staff
Manager
Nice! That sounds like a cool weekend project :)

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!