
Homepage
--------
   http://www.steve.org.uk/Software/mod_ifier

CVS Repository
--------------
   http://mod_ifier.cvsrepository.org/



mod_ifier
---------

  mod_ifier is an Apache 2.x module which is designed to stand 
 in front of requests to your Apache server and allow you to filter
 out malicious, or other undesirable connections.

  The module works by processing a set of rules which are used to filter
 incoming connections.  Whenever a match is made you can choose what
 to do:

   *  Run an external command, perhaps to firewall the client away.

   *  Redirect to an arbitary URL.

   *  Respond with a specific HTTP status code, perhaps 403/Access Forbidden.

   *  Logging to a file.


Rules
-----

  When the module is installed and enabled you can add use several new
 directives to write your filtering rules.  These rules are currently
 global, that is per-server, but if there is any interest in per-virtual host
 or per-directory rules that could be possible in the future.

  The following directives are recognised:

    DropAction  [execute=/path/to/script|status=NNN|redirect=http://...]
      Specify the default action to take on a successful match.  The action
     may be a specific HTTP status code, a command to execute or an URL to
     redirect to.
      Multiple options may be comma-seperated.  However you may clearly
     only redirect to an URL *or* return a status code, not both.

    DropAgent "Regular Expression"  ["action string"]
      Drop a connection based upon the submitted user-agent header.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropBlacklist "ip/cdir"
      Always drop the given IP address, or CIDR range.

    DropHeader "HeaderName" "Regular Expression" "action string"
      This directive allows you to match the contents of an arbitrary header.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropMethod "METHOD" ["action string"]
      Drop incoming requests which use the specified method.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropLog "/path/to/logfile"
      This allows you to specify a logfile to be updated when a match is made.

    DropReferer "Regular Expression" ["action string"]
      Drop a connection based upon the submitted referer header.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropPath "/path/to/drop" ["action string"]
      Drop a request for the given path.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropParam "parameter name"
      Drop any CGI request with the specified parameter present.

    DropParamValue "parameter name" "Regular Expression" ["action string"]
      Drop any CGI request with the specified parameter present matching
     the pattern given.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropParamValues "Regular Expression" ["action string"]
      Drop any CGI request which has any parameter present matching the
     supplied regular expression.
      The optional action string is one valid for DropAction and applies to
     this rule only.

    DropWhitelist "ip/cdir"
      Never drop the given IP address, or CIDR range.

  DropAgent and DropReferer are both utility methods which are simple
 wrappers around DropHeader.

  For example "DropAgent lynx" is identical to "DropHeader Referer lynx".



Example Configuration
---------------------


  There is an example configuration included in the file "docs/example.conf".


BUGS
----

  Please report any bugs to the author.


TODO
----

  1. ...?!


Steve
-- 
$Id: README,v 1.33 2006/08/27 23:37:30 steve Exp $
