Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: (2.5.8)
PHP version: (5.3.3)
MySQL version: (5.1.39)
Host: (optional, but it helps us help you)
Admin Tools version: (2.4.4)

Description of my issue:

We have a particularly obnoxious attacker trying to force admin entry in a number of sites we administer. They use different IP addresses, but they all originate from kimsufi.com in France. This is typical: http://screencast.com/t/aMLCZhAqerSN So far we have been blocking individual IPs using the security exceptions log, but we get up to 10 attacks a day on several sites, and this is time consuming. I am a newbie to htaccess, and my question is:

Can I set a custom htaccess rule like this:

<Limit GET HEAD POST>
order allow,deny
deny from kimsufi.com
allow from all
</LIMIT>

Would I put this at the end of the htaccess file in the htaccessmaker?

Many thanks
George

This rule works at the bottom of the .htaccess:

# RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} nastyURL\.com [NC]
RewriteRule .* - [F]

Remember to use the \ in front of the period in the URL.

Uncomment the RewriteEngine or FollowSymlinks as required.

To block more than one, use this:

# RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} nastyURL\.com [NC, OR]
RewriteCond %{HTTP_REFERER} peskyURL\.com [NC]
RewriteRule .* - [F]

This solved a very specific problem for me, in that someone had gained control of a web server, and was attempting to force administrator access to a number of different sites we administer, using an entire galaxy of different IP addresses, but were kind enough to provide their domain name in the whois info. This solution has saved me from dealing with the 30-40 emails per day I had to deal with previously.

Surprisingly Nicholas, I would say that almost half the query strings in the exceptions logs show the referrer. Just a poor class of hackers operating these days, I guess.

BTW: When we install a fresh Joomla! site, we kickstart a backup from MAMP with a common suite of extensions already installed and updated. AT Pro and Backup Pro are at the top of the list. They should be "Desert Island" components for any Joomla! site!

Many thanks for your hard work!