Log inRegister
FOSWIKI issues on Strato VPS server
Toch nog altijd attacks?
Apache error.log:[Sat Aug 22 00:15:59.757016 2026] [mpm_worker:error] [pid 980:tid 980] AH00286: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting [Sat Aug 22 00:16:23.780336 2026] [mpm_worker:error] [pid 980:tid 980] AH00287: server is within MinSpareThreads of MaxRequestWorkers, consider raising the MaxRequestWorkers setting
UFW of IPTABLES (14/08/2026)
- UFW = Ubuntu Firewall
Step 1: Install ipset
First, install ipset and the tool that keeps your rules active after a reboot:sudo apt update sudo apt install ipset iptables-persistent -y
Step 2: Create the IP List
Create a text file containing your 450 IP addresses, with one IP per line:vi /tmp/bad_ips.txtPaste your IPs, then save and exit.
Step 3: Create the Set and Load the IPs
Run these commands to create a high-speed set named blacklist and automatically load your 450 IPs into it: # 1. Create a set that holds up to 65,536 IP addressessudo ipset create blacklist hash:ip# 2. Loop through your file and add the IPs to the set
while read -r ip; do [ -n "$ip" ] && sudo ipset add blacklist "$ip"; done < /tmp/bad_ips.txtIf you get the following errors:
: resolving to IPv4 address failedparse 1.2.3.4then make sure your list doesn't contain hidden Windows carriage returns, otherwise, in vi, remove them executing the following command:
:set fileformat=unix# 3. Clean up the temporary file
rm /tmp/bad_ips.txt
Step 4: Tell the Firewall to Block the Set
Now, tell your system firewall to instantly drop any traffic on web ports (80 and 443) that matches your blacklist:sudo iptables -I INPUT -m set --match-set blacklist src -p tcp --dport 80 -j DROP sudo iptables -I INPUT -m set --match-set blacklist src -p tcp --dport 443 -j DROP
Step 5: Make it Permanent (Survival After Reboot)
By default, ipset structures vanish when the server restarts. Save them permanently with these commands: # Save the ipset listsudo ipset save > /etc/iptables/ipset.rules# Save the iptables firewall rules
sudo iptables-save > /etc/iptables/rules.v4To ensure ipset restores before iptables loads on reboot, open the netfilter-persistent configuration:
sudo vi /usr/share/netfilter-persistent/plugins.d/10-ipsetsAnd enter the following code:
#!/bin/sh
case "$1" in
start)
if [ -f /etc/iptables/ipset.rules ]; then
ipset restore < /etc/iptables/ipset.rules
fi
;;
save)
ipset save > /etc/iptables/ipset.rules
;;
flush)
ipset flush
;;
*)
echo "Usage: $0 {start|save|flush}" >&2
exit 1
;;
esac
exit 0
Make the script executable:
sudo chmod +x /usr/share/netfilter-persistent/plugins.d/10-ipsetsTest your work:
sudo netfilter-persistent save
Managing Your Blacklist in the Future
The beauty of ipset is that you can add or remove IPs instantly without touching your firewall rules again:- To add a new bad IP: sudo ipset add blacklist 1.2.3.4
- To remove an IP: sudo ipset del blacklist 1.2.3.4
- To view your list: sudo ipset list blacklist
Iedereen toelaten behalve enkele ip's vs niemand toelaten behalve enkele ip's (16/07/2026)
Shared hosting (HostingSquad)
In de .htaccess vd wiki:### IEDEREEN TOELATEN BEHALVE ENKELE IP'S ###
Require all granted
# STIJN WERK - om te testen of de config werkt:
# Require not ip xxx.yyy.zzz.aaa
Require not ip 47.128
Require not ip 47.239
# Require not ip 78.23.200
Require not ip 85.208.96
# Require not 91.183.109.216
Require not ip 114.119
Require not ip 135.181.210.147
Require not ip 157.90.182.28
Require not ip 185.191.171
Require not ip 192.159.99.170
Require not ip 52.167.144.159
Require not ip 2a01:239:30b:8400::1
# ### NIEMAND TOELATEN BEHALVE ENKELE IP'S ###
# Require all denied
# # STIJN WERK:
# Require ip xxx.yyy.zzz.aaa
# # STIJN THUIS:
# Require ip xyz.yza.zab.abc
VPS (Strato)
Op de VPS-server lukt het bovenstaande in de .conf-file (ipv .htaccess) wel voor 'niemand toelaten behalve enkele ip's', maar 'iedereen toelaten behalve enkele ip's' lukt niet... Ik bleef maar in rondjes draaien met de volgende foutmeldingen:-
not allowed in context - negative Require directive has no effect in
directive - apache 2.4 virtual host deny range of ip's
- SetEnvIf ip range
RewriteEngine onEn dan een aparte hosts.deny, met daarin de afzonderlijke IP's:
RewriteMap hosts-deny "txt:/srv/conf/sites/hosts.deny"
RewriteCond "${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND}" "!=NOT-FOUND"
RewriteRule "^" "-" [F]
## hosts.denyDe 57.141.20-reeks is erbij gekomen op 07/04/2026, na voelbare vertragingen van het systeem. Op dat ogenblik bevatte wiki/working/tmp 82.412 cgisess_... bestanden. Ik kon die niet verwijderen vanuit een PuTTY -venster, enkel via WinSCP, maar dat duurde dan wel 26 uur en 52 minuten... Voordeel is ook: je kunt deze hosts.deny 'live' wijzigen: je moet de Apache-config niet herladen of herstarten, de wijzigingen zijn instant! Sources:
##
## ATTENTION! This is a map, not a list, even when we treat it as such.
## mod_rewrite parses it for key/value pairs, so at least a
## dummy value "-" must be present for each entry.
##
20.171.207.1 -
...
20.171.207.255 -
57.141.20.0 -
...
57.141.20.59
- eXplio
- https://httpd.apache.org/docs/2.4/rewrite/access.html#host-deny
- https://techexpert.tips/apache/apache-blocking-ip-address-list/
Installeren
Niet gevolgd, maar later gevonden: How to Install Foswiki on Ubuntu 24.04 with Apache | Geek Rewind tags: Apache 2.4 virtualhost virtual host blocklist block list IP address addresses
Copyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors. Ideas, requests, problems regarding Foswiki? Send feedback