Translated from 日本語 • View original Hello. This is Komiya from the platform.
When I tried to reject overseas with apache's mod_geoip module,
We have responded by not displaying Facebook images.
・I needed whois, but it wasn't included, so I looked up the package name on another server and introduced it.
[shell]$ which whois /usr/bin/whois # rpm -qf /usr/bin/whois jwhois-3.2.2-1
# yum install jwhois Installed: jwhois.x86_64 0:4.0-19.el6 # which whois /usr/bin/whois[/shell]
・Check how to obtain the allowlist on FB official
It is officially written to get a regular update list with the following command.
App Security - Facebook Developers
[shell]# whois -h whois.radb.net -- '-i origin AS32934' | grep ^route:|awk '{print $2}' 204.15.20.0/22 69.63.176.0/20 omitted 69.63.184.0/21 66.220.144.0/20 69.63.176.0/20[/shell] *It was about 65 blocks. Manual work is impossible, so I try to automate it somehow.
・Consideration of how to add settings
I'll think about whether I can add something to this.
[shell]# cat /etc/cron.monthly/geoip #!/bin/bash wget -q http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz gunzip GeoIP.dat.gz mv -f GeoIP.dat /usr/ share/GeoIP/GeoIP.dat[/shell]
dat is binary, so it is difficult to add it yourself. No one does that even if you google it lightly.
[shell]# file /usr/share/GeoIP/GeoIP.dat /usr/share/GeoIP/GeoIP.dat: data[/shell]
It seems that you have no choice but to set it with apache Allow from, etc.
SetEnvIf to check if it can't be used Reference:
Apache Allow, Deny directives and want to condition - (h) note
I thought it might be a good idea to make it an env called PassCountry with SetEnvIf Remote_Addr.
It is not clear whether CIDER can be specified in Remote_Addr. Probably not.
apache - Redirect a range of IPs using RewriteCond - Stack Overflow
or
Include is a
"The settings inserted by Include are treated as if they were in the position of the Include directive of the file you are inserting."
It was written in the section merging method.
Section Configuration - Apache HTTP Server
Therefore, it is considered realistic to set aside the file with Allow from and load it at the required position as needed.
/etc/cron.monthly/geoip in the direction of adding the following:
[shell]whois -h whois.radb.net -- '-i origin AS32934' | grep ^route:|awk '{print $2}'|sed -e 's/^/Allow from /g' > /etc/httpd/conf/extra/allow_fb_ip[/shell]
Under Allow from env=PassCountry
[shell]Include conf/extra/allow_fb_ip[/shell].
・Add settings
[shell]# cp -p /etc/httpd/conf/extra/*****.com.conf{,.`date +%Y%m%d`} # vi /etc/httpd/conf/extra/*****.com.conf <Directory "/home/***-web/public_html"=""> AllowOverride All Order deny,allow Deny from all <IfModule mod_geoip.c=""> GeoIPEnable On SetEnvIf GEOIP_COUNTRY_CODE JP PassCountry Allow from env=PassCountry Include conf/extra/allow_fb_ip ← ★ added here
# diff /etc/httpd/conf/extra/*****.com.conf{,.`date +%Y%m%d`} # apachectl configtest Syntax OK # apachectl graceful # netstat -lnpt # tail -f /var/log/httpd/20131108_access_ log # tail -f /var/log/httpd/20131108_error_log[/shell]
There are no logs that seem to be related.
Perform the same settings for others.
As for geoip, there are other configs as follows:
[shell]# cat /etc/httpd/conf.d/geoip.conf LoadModule geoip_module modules/mod_geoip.so
<IfModule mod_geoip.c=""> GeoIPEnable On GeoIPDBFile /usr/share/GeoIP/GeoIP.dat [/shell]
It seems that it was okay to ask the development side to confirm whether the FB image was displayed.
/etc/cron.* seems to be randomized by anacron from centos6 to anacron.
I think anacron was stopped, so I'll write it in crontab.
[shell]# mv /etc/cron.monthly/geoip /opt/bin/
# crontab -e ## geoip database update 3 0 * * * /opt/bin/geoip[/shell] (I was doing it monthly at first, but I was asked to do it daily, so I fixed it)
OSS flies on aluminum wings: RHEL6 (7)cron and anacron
Thank you for watching the above.