7G Firewall : Log Blocked Requests

20 responses to “7G Firewall : Log Blocked Requests”

1. 

   Jim S Smith 2019/02/16 9:14 pm • Reply

   I checked out the PHP coding, looks pretty good and simple. I didn’t know about “parse_url()”, at first, because my PHP documentation apparently did not have it! – Oops! Pretty darn useful function.

   Anyway,

   I changed the log-file name to something like: 7g_log.log, because I already disallow access to all “log” files.

   Some of these filtering rules (namely those for User-Agent, Host, Referer, and even Request_URI [YES – uses underline separator instead!] ) also work very well with SetEnvIfNoCase directives. I set an environment variable for any positives (to something like “bad_bot”) – which results in setting $_SERVER[‘bad_bot’] – OR – $_SERVER[‘REDIRECT_bad_bot’] (as in the case of trapping a bad “Request_URI”).

   In using this method,

   I can use a module, from within an “errordoc” program, to trap out mischief, by reading the custom environment variable that was set, and doing whatever with that visit, IP, or whichever.

   BTW: Pretty awesome REGEX’s in the lot! I have a few others I have been using to trap bad “THE_REQUEST” header field values.

   Thank you for the quality info you publish. I have learned to be a bit more creative with my solutions, on account of some of the fine solutions you have presented.

   – Jim S.

   • 

     Jeff Starr 2019/02/17 10:07 am • Post Author • Reply

     Thanks Jim, always appreciate your feedback and thoughts. I did initially write 7G using SetEnvIfNoCase directives, but there were certain sections (I forget which ones) that were not picking up. So I went with mod_rewrite as it is more universal in effectiveness. Hopefully you find some benefit with all of it, and thanks again for all of your inputs and ideas.

2. 

   David 2019/04/09 12:08 pm • Reply

   Hi

   First of all id like to let you know how much technical ability i have ……… 0.3 :)

   I recently built a website using DIVI. I hosted it with site-ground and they are the reason i find myself here. They recommend your 6G script and have it set out on their help pages so that it can be easily copied and pasted to the .htaccess file (which i have done)

   Obviously, id like to set uo the 7G but when it comes to the set up here im lost. Is there anyway to get it so i can copy and paste directly with out getting blindsided with technical instructions.

   Apologies for troubling you in advance!

   • 

     Jeff Starr 2019/04/09 3:31 pm • Post Author • Reply

     I wrote the instructions to be as clear as possible, but they do assume a certain level of understanding. If anything is not clear in the installation steps let me know and I will try to expand/clarify. Otherwise it should be recommended to get an experienced developer to implement properly.

3. 

   Bernd 2020/01/05 2:35 pm • Reply

   Hi Jeff, concerns 7g_log.php My server was telling me that there is a problem in line 171

   $string = (!empty(SEVENGUALENGTH)) ? substr($string, 0, SEVENGUALENGTH) : $string;

   using your defaults

   define('SEVENGUALENGTH', 0);

   For troubleshooting I commented this line out and every works fine now.

   Any idea what’ wrong?

   Bernd.

   • 

     Jeff Starr 2020/01/05 3:58 pm • Post Author • Reply

     Hi Bernd, if you can be more specific and provide the actual PHP error/warning, I will take a look asap. Thank you.

     • 

       Bernd 2020/01/06 5:54 am

       Jeff, the server errorlog file says this
       [Mon Jan 06 14:49:17 2020] [warn] mod_fcgid: stderr: PHP Parse error: syntax error, unexpected ')', expecting :: (T_PAAMAYIM_NEKUDOTAYIM) in xxxx/7g_log.php on line 171

     • 

       Jeff Starr 2020/01/06 8:57 am • Post Author

       Thanks I am looking into this now. Just glancing at line 171 I cannot find any error with the default download script. Will run full tests later and report back. In the meantime, can you let me know the version of PHP and Apache you are using, or send via email if preferred. Thank you Bernd.

     • 

       Bernd 2020/01/06 9:24 am

       well Sys Info is telling this
       Server OS Apache
       PHP Version 5.4.45

     • 

       Jeff Starr 2020/01/06 11:17 am • Post Author

       Thanks. It could be an issue with the old/outdated PHP version (5.4 is pretty old). So you may want to try re-downloading the script and/or upgrading PHP to something newer (like v7+). The script runs fine (no errors or warnings) on PHP 7 and better.

     • 

       Bernd 2020/01/06 12:12 pm

       this is a service provider and I have no chance to ask for an update.
       Jeff, did you made any update on your 7G_log.php file?
       Best Regards Bernd.

     • 

       Jeff Starr 2020/01/07 1:34 am • Post Author

       No because I did not find any error (running PHP 7.3). I’ll try to set up an old PHP version and retest at some point, likely for the next 7G update.

4. 

   Alexey 2023/02/06 5:16 pm • Reply

   Since the site is located behind the CND, I corrected the log function. Maybe something like this will be useful to you in your projects.

   function perishablePress_7G_ip_address() {
   	
   	$string = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
   	
   	// If connecting through Cloudflare, rely on Cloudflare's connecting-IP header to get IP, otherwise check server header
   	
   	if(isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
   		
   		$string = '[Cloudflare reports] '. $_SERVER['HTTP_CF_CONNECTING_IP'] .' / '. $string;
   		
   	} else {
   		
   		//
   	}
   	
   	$match = isset($_SERVER['REDIRECT_7G_IP_ADDRESS']) ? $_SERVER['REDIRECT_7G_IP_ADDRESS'] : '';
   	
   	return perishablePress_7G_get_patterns($string, $match);
   	
   }

5. 

   Anonymous User 2023/02/06 5:27 pm • Reply

   Editor’s note: This information was sent in by a 7G user. I am unable to locate the original email/name. If it’s you, let me know and I’ll be glad to update the comment with your infos.</note>

   I was continuing to have issues with 7G log not [bracketing] correctly. I traced it down to Apache configuration differences. I searched for “apache adds REDIRECT_ to environment variables”. One article which explains the issue.

   In short, my config of Open Litespeed does not prepend REDIRECT_ to some environment vars, and I think that is the case for some apache configs. To fix, I replaced all REDIRECT_ with empty in 7G_log.php. I’d imagine there is some rewrite you could do to account for both possibilities depending on varying configs in the next update.

   Update: I tracked it down to the use of REDIRECT_QUERY_STRING vs QUERY_STRING in perishablePress_7G_check(). Below is part of the $_SERVER array. I changed the code in 7G_log.php to check against QUERY_STRING and it now works fine. I don’t know if this is a Litespeed thing, but I thought you might want to know in case it’s a larger bug. If you need more of the $_SERVER array, let me know.

   [REQUEST_URI] => /?browsersploit
   [REDIRECT_URL] => /
   [REDIRECT_QUERY_STRING] => browsersploit
   [HTTPS] => on
   [7G_QUERY_STRING] => browsersploit______
   [REDIRECT_STATUS] => 200
   [SSL_PROTOCOL] => TLSv1.3
   [SSL_CIPHER] => TLS_CHACHA20_POLY1305_SHA256
   [SSL_CIPHER_USEKEYSIZE] => 256
   [SSL_CIPHER_ALGKEYSIZE] => 256
   [LSWS_EDITION] => Openlitespeed 1.6.21
   [X-LSCACHE] => on,crawler
   [QUERY_STRING] => log
   [SCRIPT_NAME] => /7G_log.php
   [SERVER_PROTOCOL] => HTTP/1.1
   [SERVER_SOFTWARE] => LiteSpeed
   [REQUEST_METHOD] => GET
   [PHP_SELF] => /7G_log.php

   • 

     George 2023/02/11 1:59 pm • Reply

     Also just fyi, on some servers, user-declared environment variables must start with HTTP_ for security purposes, e.g.: SetEnv HTTP_MY_VARIABLE "my value"

6. 

   7G User 2023/02/06 5:38 pm • Reply

   In order to get logging-script working, I have to set in htaccess:

   RewriteRule .* - [E=REDIRECT_QUERY_STRING:log]

   Seems to be undocumented or did I miss something to read?

   • 

     Jeff Starr 2023/02/06 5:41 pm • Post Author • Reply

     Thanks for sharing this, also note that there are additional environmental variables for each set of firewall rules, for example:

     $_SERVER['REDIRECT_7G_QUERY_STRING']
     $_SERVER['REDIRECT_7G_REQUEST_URI']
     $_SERVER['REDIRECT_7G_USER_AGENT']
     .
     .
     .

     So you would want to add similar rewrite rules for each.

7. 

   Luca 2023/05/24 1:33 am • Reply

   Hi, I have a website with many spam pages in Excluded by “noindex” tags like these: “?s=%E5%A4%A7%E5%A5%96%E5%A8%B1%E4%B9%90% E6%98%AF%E8%80%81%E5%93%81%E7%89%8C%E4%B9%88+Q82019309.com.com” when I installed 7G firewall I noticed that the spam pages in Excluded by “noindex” tag decreased but increased on 404 pages in Google Serach Console.

   Is it possible to set the code by sending these spam pages to 410?
   Thanks

   • 

     Jeff Starr 2023/05/24 1:06 pm • Post Author • Reply

     Yes it’s possible. As-is, the firewall sends a 403 Forbidden response to all blocked requests. To change that, replace each instance of [F] with [R=410,L] or similar.

8. 

   Marios 2023/12/01 10:46 am • Reply

   Just a suggestion… space dash space isn’t a great delimiter if you’re going to use something like Excel to put things into nice columns for filtering/searching. I’ve modified the script to use a pipe.

   Thanks for all you do and the information you’ve provided.