Anyone help stopping POST to php scripts in apache

[blazin]

Got a nasty virus that updates files via post to php scripts... want to stop it at apache... anyone know how?

Please!

[HomerSimpson]

try by installing mod_security...
If you have it installed just apply this rule at your htaccess

<IfModule mod_security.c>
# Sends matching requests a 405 Method Not Allowed Status Code
SecFilterSelective REQUEST_METHOD "!^(GET|HEAD|OPTIONS)$" "deny,auditlog,status:405"
</IfModule>

This should block ALL POSTS and will show 405 error.

I have used mod_security but never used this rules so I don't know if it works.
I found those rules on this page (modified it a bit to suite your needs)
http://www.askapache.com/htaccess/mo...ss-tricks.html

[blazin]

Thanks.... looks like that might be useful.

[Varius]

You can probably use the <Limit></Limit> in your vhost or .htaccess or whatever, something like:

<Limit POST>
Require valid-user
</Limit>

or

<Limit POST>
Deny from all
</Limit>

Didn't try it, but pretty sure that's what the <Limit> item is for

[blazin]

Originally Posted by Varius

You can probably use the <Limit></Limit> in your vhost or .htaccess or whatever, something like:

<Limit POST>
Require valid-user
</Limit>

or

<Limit POST>
Deny from all
</Limit>

Didn't try it, but pretty sure that's what the <Limit> item is for

Thanks Varius