[NCLUG] Apache Config - deny from certain User Agent?

[Rich Young]

I've got this in and running, but my access logs still show the
offending bot getting 200 return codes (sometimes even on files that
don't exist on the server) - and I thought I'd just directed it to
return 403 Forbidden!  Does mod_rewrite somehow affect logging in some
way that would explain this?  Am I missing something?

--------------------------
I'm Rich Young, and I approved this message.
 

> -----Original Message-----
> From: nclug-bounces at nclug.org 
> [mailto:nclug-bounces at nclug.org] On Behalf Of Stephen Warren
> Sent: Tuesday, October 31, 2006 3:35 PM
> To: Northern Colorado Linux Users Group
> Subject: Re: [NCLUG] Apache Config - deny from certain User Agent?
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Rich Young wrote:
> > I've been having some trouble with a certain bot attempting 
> to comment 
> > spam blogs on our web server, which my aging server handles very 
> > poorly
> > - the result is similar to a DoS attack.  Unfortunately, 
> the traffic 
> > is not coming from any single IP range, but it does seem to all be 
> > self-identifying as a specific user agent (WebaltBot).  Does anyone 
> > know if it's possible to create a directive in the Apache 2.0 conf 
> > file that simply rejects traffic from this user agent?  
> I've looked at 
> > BrowserMatch, but it's intended only to set environment variables.
> 
> Set an env. var using BrowserMatch, then do this to block them:
> 
> LoadModule rewrite_module modules/mod_rewrite.so 
> RewriteEngine On RewriteCond %{ENV:is_bad_robot}=1 
> RewriteRule ^.*$ - [F]
> 
> or something like that...
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iD8DBQFFR8+phk3bo0lNTrURAoxsAKDoIbNe007KhrGtSqE3wAok7dOCawCdGgNK
> i7PPh6ZvQpHI0mkHoVEmHVI=
> =Q3l9
> -----END PGP SIGNATURE-----
> _______________________________________________
> NCLUG mailing list       NCLUG at nclug.org
> 
> To unsubscribe, subscribe, or modify
> your settings, go to: 
> http://www.nclug.org/mailman/listinfo/nclug
>