I download Mod GeoIP 1.2.8 for Apache 2.4.x x64 from AH.But,it shows can't load mod_geoip.so at conf file.I make a try to download Mod GeoIP 1.2.7 for Apache 2.4.x x64 from AH,it runs well.
Does it something wrong with Mod GeoIP 1.2.8 for Apache 2.4.x x64? ;)
Possibly, what version of Windows are you running?
It's not loading on my XP x86, but loads fine on my Vista x86. I realize your talking x64 though. I think I'll put 1.2.7b back on the download page anyway.
I run it under win 2008R2 server(apache2.4).And,I find it can't set allowed country code either both 1.2.7 and 1.2.8 via http://dev.maxmind.com/geoip/legacy/mod_geoip2/ (http://dev.maxmind.com/geoip/legacy/mod_geoip2/).Is there any right directive to provide to tuning?
GeoIPEnable On
GeoIPDBFile /path/to/GeoIP.dat
SetEnvIf GEOIP_COUNTRY_CODE US AllowCountry
SetEnvIf GEOIP_COUNTRY_CODE CA AllowCountry
SetEnvIf GEOIP_COUNTRY_CODE MX AllowCountry
# ... place more countries here
<Directory "/path/to/some/website">
# your Options and AllowOverrides and anything else
Require env AllowCountry
</Directory>
I believe the above should work in 2.4
I'm surprised 1.2.8 doesn't load in 2008R2, It should in Vista and up. Do you get a "The specified procedure could not be found." in the error message?
I have it running on a 32-bit Windows 2008 server. Made no changes whatsoever to my .conf files when upgrading from 1.2.7b to 1.2.8.
- S
Gregg:
Can you post Block country full directives fro httpd.conf use? :)
The allowed directives works fine.And,I need the block directives too.
Quote from: Gregg on June 26, 2013, 11:31:47 PM
GeoIPEnable On
GeoIPDBFile /path/to/GeoIP.dat
SetEnvIf GEOIP_COUNTRY_CODE US AllowCountry
SetEnvIf GEOIP_COUNTRY_CODE CA AllowCountry
SetEnvIf GEOIP_COUNTRY_CODE MX AllowCountry
# ... place more countries here
<Directory "/path/to/some/website">
# your Options and AllowOverrides and anything else
Require env AllowCountry
</Directory>
If I remember correctly, it was
SetEnvIf GEOIP_COUNTRY_CODE US BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE CA BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE MX BlockCountry
# ... place more countries here
<Directory "/path/to/some/website">
# your Options and AllowOverrides and anything else
<RequireAll>
Require all granted
Require not env BlockCountry
</RequireAll>
</Directory>
although I do see this in my config
<RequireAll>
Require all granted
<RequireNone>
Require env BlockCountry
</RequireNone>
</RequireAll>
Thanks.And..
Would yould please to fix mod_geoip1.2.8 for 2008R2 x64 to use?
Gregg:
I can concur that there is an issue with the 64-bit Mod_GeoIP module. I have a 64-bit Windows8 development box running the 64-bit version of Apache 2.4.4. I replaced Mod_GeoIP 1.2.7b with 1.2.8 and Apache 2.4.4 would not start. The moment I reverted back to 1.2.7b, Apache 2.4.4 started.
- S
OK, thanks for the reports. Am pulling 1.2.8 now. Look for 1.2.8a in the near future.
OK, 1.2.8a is available. I hope these work for you. It's impossible to get any kind of debugging data on windows short of installing a full version of Visual C++. So if I cannot duplicate the problem, it's hard to track it down.
Mod_geoip1.2.8a works under 2008R2 now. :)
And,what is the directive of allowed ip(such as private ip...or another blockcountry ip..) at blockcountry setting.I try to use "allow from 192.168.0.0/16" directive,but not works.
Allow from is not 2.4 style. Use the require style.
Require ip 192.168
It shows "systax error and unknown authz provider" when use "require" directive under apache2.4.4 ::)
So strange?
is mod_authz_host loaded?
I turn off mod_authz_host,but it shows syntax error when I use "require".I can't believe it can accept allow and deny directives under apache2.4.x still.I am sure I use apache 2.4.x now.Though I load mod_access_compat for compatibility with old configurations.
I should use both allow and require directives.Isn't it?
But,the allow from 192.168.0.0/16 doesn't take effects.I can't understand..
Quote from: chromerep on June 29, 2013, 09:31:50 AMIs it apache 2.4.4 bug?
No.
To use
Require, mod_authz_core
must be loaded!
http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require
See in the box at the top of the docs for Require, where it says "Module: mod_authz_core"
To use
Require ip or
Require host, mod_authz_host
must be loaded
http://httpd.apache.org/docs/2.4/mod/mod_authz_host.html
Yes, you can use Order/Allow/Deny in 2.4 if mod_access_compat is loaded. I have found that you can not use both Require and Order/Allow/Deny in your config. One of them will win and usually Require loses the fight. So if you are using both, anything configured with Require will 403.
It is recommended to use Require only in 2.4 and just unload mod_access_compat.
Thanks.
I unload mod_access_compat and load mod_authz_core,mod_authz_host,it can run the "require" directive now.
But,I require ip X.X.X.X from blockcountry code,it can't access to the web.
Does it mean the require ip not to take effects?
Post your require statements so I can see what you have. It should still allow the IP but it may depend on what you are doing.
my require statements:
<IfModule geoip_module>
GeoIPEnable On
GeoIPEnableUTF8 On
GeoIPScanProxyHeaders On
GeoIPUseLastXForwardedForIP On
GeoIPOutput Env
GeoIPDBFile /path/GeoIP.dat
SetEnvIf GEOIP_COUNTRY_CODE XX BlockCountry
<Directory "/path/to/some/website">
Require ip X.X.X.X
<RequireAll>
Require all granted
<RequireNone>
Require env BlockCountry
</RequireNone>
</RequireAll>
</Directory>
</IfModule>
try
<RequireAll>
Require all granted
Require ip X.X.X.X
<RequireNone>
Require env BlockCountry
</RequireNone>
</RequireAll>
It works now.But,the loading of web page become unstable when load the mod_geoip.The web's component(such as icon,images...) can't load normally.Some become unloaded.
I make a try,I unload the mod_geoip,the web page loads normally.
Maybe it's mod_geoip's minor issue?And,is the mod_geoip same as the maxmind provieded?(http://dev.maxmind.com/geoip/legacy/mod_geoip2/ (http://(http://dev.maxmind.com/geoip/legacy/mod_geoip2/))Can AH compile this version? :)
Yes, it is that version.
You know, this version isn't 100%. As a matter of fact, I have not ever had a version of mod_geoip that was ever 100%. A problem is that if you look at a typical request, the majority will be correct, but some will not. So if you are using mod_geoip to block, then some things may not show up.
I use mod_geoip mainly for knowing where visitors come from, nothing more. I add the country to the end of each line in my access log. Doing this, I can see that it fails on occasion. For instance, if you go to my server's index.html page, it will make 14 requests, index.html, 3 fonts and 10 images. Looking at one such request in today's log I have:
203.147.5.xxx
10 of the 14 say Thailand, 1 United States, 1 Greece, 1 Bhutan and one that came back as nothing.
Obviously Thailand is the correct one, but if I had a block on the country Bhutan, this visitor wouldn't get the image /icons/blank.gif.
This problem was discussed before here (https://forum.apachehaus.com/index.php?topic=710.0). I got to thinking about this after my short answer that this is the latest version.
I think if I really cared to block a country, I'd only block the .html, .php and any other similar file like that. I've never seen the first request fail to the server fail, and blocking these files would not stop images loading for people that were allowed to see the .html/php/etc. files because a mod_geoip failed on a subsequent request.
Just a thought.
Yeah.Your thought is a good way to think.
If I just want to block the country to view "php/html..",what is the directives it need to add the conf file?Can you post a detail sample for me to reference?I can't find that at maxmind documents.
No, you will not find an example at maxmind, but you do have an example in your conf making the viewing/downloading of .ht(access|passwd) files impossible. There are also a lot of examples of access control in the Apache docs, you just use a little imagination with what you know.
Outside of any virtualhost or directory containers, you may be able to use something similar to:
<Files ~ "\.(html?|php|cgi)$">
#Put your access stuff here
</Files>
In this sample,how to block some country codes to access php/html only..except icon,images..?I am so fool to figure out it.(I check apache access control documents before)Can give any advanced sample?
Quote from: Gregg on July 03, 2013, 12:15:17 AM
<Files ~ "\.(html?|php|cgi)$">
#Put your access stuff here
</Files>
I find that using mod_geoip is a great way to keep unwanted visitors from certain countries. I am mean in that i block visitors from certain countries from viewing everything. I do not want them to have the opportunity to even begin to search for any sort of exploit/s nor do i want them to scavenge any info to use for their spamming / bots / hacks / etc.
chromerep, how about replacing
#Put your access stuff here
with
<RequireAll>
Require all granted
Require ip X.X.X.X
<RequireNone>
Require env BlockCountry
</RequireNone>
</RequireAll>
After add those directives,the former web loading issue occurs again.It seems the mod_geoip issue,can't get resolved untile turn it off.
Here is how mine is configured, if this may shed any light towards a resolution.
<Directory>
SetEnvIf GEOIP_COUNTRY_CODE 1 BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE 2 BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE 3 BlockCountry
Substitute the numbers with actual country codes
<RequireAll>
Require all granted
<RequireNone>
Require env BlockCountry
</RequireNone>
</RequireAll>
</Directory>
Here are some error log from mod_geoip at httpd.conf:
GeoIP: Error Traversing Database for ipnum = 3410457733 - Perhaps database is corrupt?
GeoIP: Error Traversing Database for ipnum = :: - Perhaps database is corrupt?
GeoIP: Error Traversing Database for ipnum = 3410457607 - Perhaps database is corrupt?
GeoIP: Error Traversing Database for ipnum = 3410457607 - Perhaps database is corrupt?
GeoIP: Error Traversing Database for ipnum = :: - Perhaps database is corrupt?
I google it,and find this post concerned about it's bug.(http://forum.maxmind.com/viewtopic.php?t=1056)
The bug appears again??
But,I don't think this issue concerned about web loading abnormally.It's another issue need to be fixed.
My config is the same as yours.But,after load mod_geoip,the web component (icon,images,css..etc)can't load normally.
Quote from: DnvrSysEngr on July 03, 2013, 06:01:57 PM
Here is how mine is configured, if this may shed any light towards a resolution.
I forgot to mention that my production version and config which I posted for you and work flawlessly are from a 32-bit version.
If I get time, I will try with the 64-bit version of my dev server over the 4th of July weekend and see if I encounter the same issue/s.
- S
You can reproduce it,but I find some php scripts has this issue,some has not.I can't say it's all php scrips causes it.It's because the mod_geoip should suit for mostly php scripts like other apache module does.
Quote from: DnvrSysEngr on July 03, 2013, 11:21:09 PM
If I get time, I will try with the 64-bit version of my dev server over the 4th of July weekend and see if I encounter the same issue/s.
Here is what I have in my httpd.conf file for Mod_GeoIP (64-bit):
LoadModule geoip_module modules/mod_geoip.so
<IfModule geoip_module>
GeoIPEnable On
# Specify full path to the database here!
# Use only one database.
# GeoIPDBFile /path/to/GeoIP.dat
# GeoIPDBFile /path/to/GeoLiteCity.dat
# IPv6 support use two databases
GeoIPDBFile bin/GeoIPv6.dat
#GeoIPDBFile bin/GeoLiteCity.dat
</IfModule>
my GeoIPv6.dat file is loaded in the bin directory per the instructions. If you are not running IPv6, then you only need the GeoIP.dat file.
DnvrSysEngr,
Thanks for your conf.
My conf for mod_geoip is the same.I think it should not the configuration issue to cause the web loading abnormal issue after loading mod_geoip.
Trying to decipher the cryptic explanations is almost pointless. None really give a clear reason nor a clear answer. However, some point to it being related to the GeoIP database.
Maybe you could try going to:
http://dev.maxmind.com/geoip/legacy/geolite/
and downloading the database you need and placing it into your bin directory and seeing if that resolves the issue?
I tried to download those geoip data files before.But,can't resolve this web issue.
I think it's mod_geoip to cause.
Try rolling back to Mod_GeoIP 1.2.7?
Also, what happens if you try to access the site you are having issues with via "localhost?"
- S
I roll back to 1.2.7,but it's the same till unload mod_geoip.
I can't figure out what happens.
Maybe it has something that stop the web component to load.