312 lines
11 KiB
ApacheConf
312 lines
11 KiB
ApacheConf
# BEGIN Security - Shared rules for all sites
|
|
# Last updated: 2026-05-22
|
|
|
|
# Block known attacker ranges (VPS/hosting providers used for brute force)
|
|
<IfModule mod_rewrite.c>
|
|
RewriteEngine On
|
|
# FranTech / PonyNET / BuyVM
|
|
RewriteCond %{REMOTE_ADDR} ^107\.189\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^209\.141\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^104\.244\.73\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^198\.98\.
|
|
RewriteRule .* - [F,L]
|
|
# WatchComm / FNI
|
|
RewriteCond %{REMOTE_ADDR} ^205\.185\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^45\.61\.18[4-8]\.
|
|
RewriteRule .* - [F,L]
|
|
# AltunHOST / hosting providers
|
|
RewriteCond %{REMOTE_ADDR} ^5\.83\.135\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^192\.109\.200\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^103\.60\.12\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^185\.198\.240\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^173\.239\.240\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^104\.234\.53\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^104\.238\.222\.
|
|
RewriteRule .* - [F,L]
|
|
# TECHOFF SRV LIMITED (scraper)
|
|
RewriteCond %{REMOTE_ADDR} ^195\.178\.110\.
|
|
RewriteRule .* - [F,L]
|
|
# Brute force attackers (May 11)
|
|
RewriteCond %{REMOTE_ADDR} ^103\.59\.161\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^185\.153\.151\.
|
|
RewriteRule .* - [F,L]
|
|
# F.N.S. HOLDINGS LIMITED
|
|
RewriteCond %{REMOTE_ADDR} ^216\.73\.160\.
|
|
RewriteRule .* - [F,L]
|
|
# DigitalOcean brute force
|
|
RewriteCond %{REMOTE_ADDR} ^143\.198\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^146\.190\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^142\.93\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^170\.64\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^134\.209\.
|
|
RewriteRule .* - [F,L]
|
|
# Cipher Operations (Serbia)
|
|
RewriteCond %{REMOTE_ADDR} ^62\.60\.130\.
|
|
RewriteRule .* - [F,L]
|
|
# UK Dedicated Servers
|
|
RewriteCond %{REMOTE_ADDR} ^185\.192\.7[0-1]\.
|
|
RewriteRule .* - [F,L]
|
|
# GSL Networks
|
|
RewriteCond %{REMOTE_ADDR} ^85\.203\.2[1-3]\.
|
|
RewriteRule .* - [F,L]
|
|
# Argon Data Communication
|
|
RewriteCond %{REMOTE_ADDR} ^157\.66\.56\.
|
|
RewriteRule .* - [F,L]
|
|
# Pfcloud UG
|
|
RewriteCond %{REMOTE_ADDR} ^217\.60\.241\.
|
|
RewriteRule .* - [F,L]
|
|
# Omegatech LTD
|
|
RewriteCond %{REMOTE_ADDR} ^158\.94\.210\.
|
|
RewriteRule .* - [F,L]
|
|
# Individual attackers
|
|
RewriteCond %{REMOTE_ADDR} ^94\.26\.106\.111$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^176\.65\.132\.166$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^37\.120\.217\.182$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^8\.210\.170\.233$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^120\.24\.67\.156$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^140\.245\.111\.5$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^20\.9\.82\.33$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^45\.156\.87\.222$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^31\.57\.184\.107$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^92\.205\.109\.21$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^72\.167\.150\.128$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^165\.154\.38\.157$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^50\.6\.207\.27$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^141\.98\.11\.117$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^136\.243\.176\.166$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^123\.30\.233\.1[2-3]$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^91\.227\.37\.60$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^78\.142\.18\.172$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^66\.116\.235\.214$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^149\.88\.110\.49$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^35\.227\.109\.86$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^103\.253\.27\.44$
|
|
RewriteRule .* - [F,L]
|
|
# Contabo (individual IP)
|
|
RewriteCond %{REMOTE_ADDR} ^85\.239\.235\.108$
|
|
RewriteRule .* - [F,L]
|
|
# xmlrpc + brute force attackers (May 22)
|
|
RewriteCond %{REMOTE_ADDR} ^105\.184\.79\.191$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^45\.94\.31\.119$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^138\.2\.98\.238$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^20\.89\.64\.143$
|
|
RewriteRule .* - [F,L]
|
|
# Vulnerability scanners (May 22-23)
|
|
RewriteCond %{REMOTE_ADDR} ^143\.92\.32\.30$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^194\.26\.192\.219$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^38\.99\.81\.38$
|
|
RewriteRule .* - [F,L]
|
|
# Massive brute force (May 23)
|
|
RewriteCond %{REMOTE_ADDR} ^193\.26\.115\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^51\.79\.177\.162$
|
|
RewriteRule .* - [F,L]
|
|
# ALFA shell scanners / 2ipcore crawler
|
|
RewriteCond %{REMOTE_ADDR} ^185\.213\.154\.185$
|
|
RewriteRule .* - [F,L]
|
|
# Vulnerability scanners (May 23 evening)
|
|
# Microsoft Azure — shell/backdoor scanner
|
|
RewriteCond %{REMOTE_ADDR} ^20\.151\.117\.104$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^4\.228\.100\.214$
|
|
RewriteRule .* - [F,L]
|
|
# 2ipcore ALFA shell scanners (expand to /24)
|
|
RewriteCond %{REMOTE_ADDR} ^2\.58\.56\.
|
|
RewriteRule .* - [F,L]
|
|
# DigitalOcean scanners
|
|
RewriteCond %{REMOTE_ADDR} ^157\.230\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^139\.59\.
|
|
RewriteRule .* - [F,L]
|
|
# Directory enumeration scanner
|
|
RewriteCond %{REMOTE_ADDR} ^91\.199\.118\.57$
|
|
RewriteRule .* - [F,L]
|
|
# ALFA shell scanners (expand to /24)
|
|
RewriteCond %{REMOTE_ADDR} ^45\.92\.1\.
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^45\.154\.98\.
|
|
RewriteRule .* - [F,L]
|
|
# Google Cloud spammer
|
|
RewriteCond %{REMOTE_ADDR} ^34\.42\.34\.237$
|
|
RewriteRule .* - [F,L]
|
|
# Azure vulnerability scanners (May 24)
|
|
RewriteCond %{REMOTE_ADDR} ^20\.48\.233\.234$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^20\.63\.100\.211$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^20\.226\.23\.23$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^20\.9\.81\.163$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^20\.63\.46\.176$
|
|
RewriteRule .* - [F,L]
|
|
# Persistent brute force (Hetzner)
|
|
RewriteCond %{REMOTE_ADDR} ^168\.119\.26\.89$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^173\.249\.4\.57$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^216\.251\.35\.201$
|
|
RewriteRule .* - [F,L]
|
|
# File enumeration scanner (May 25)
|
|
RewriteCond %{REMOTE_ADDR} ^158\.158\.44\.35$
|
|
RewriteRule .* - [F,L]
|
|
# Reconnaissance bots / Tor (May 25)
|
|
RewriteCond %{REMOTE_ADDR} ^149\.102\.230\.133$
|
|
RewriteRule .* - [F,L]
|
|
RewriteCond %{REMOTE_ADDR} ^82\.102\.18\.116$
|
|
RewriteRule .* - [F,L]
|
|
# Directory scanner (May 25)
|
|
RewriteCond %{REMOTE_ADDR} ^195\.3\.220\.7$
|
|
RewriteRule .* - [F,L]
|
|
# Azure shell scanner (May 25)
|
|
RewriteCond %{REMOTE_ADDR} ^20\.226\.59\.228$
|
|
RewriteRule .* - [F,L]
|
|
# WP installer scanner (May 26)
|
|
RewriteCond %{REMOTE_ADDR} ^194\.26\.192\.75$
|
|
RewriteRule .* - [F,L]
|
|
# Azure webshell scanner (May 26)
|
|
RewriteCond %{REMOTE_ADDR} ^104\.43\.242\.179$
|
|
RewriteRule .* - [F,L]
|
|
# Block non-existent plugin/theme probes (saves PHP workers)
|
|
RewriteRule ^ALFA_DATA/ - [F,L]
|
|
RewriteRule ^alfacgiapi/ - [F,L]
|
|
</IfModule>
|
|
|
|
# Block xmlrpc.php
|
|
<Files xmlrpc.php>
|
|
<IfModule mod_authz_core.c>
|
|
Require all denied
|
|
</IfModule>
|
|
</Files>
|
|
# END Security
|
|
|
|
# --- Security headers ---
|
|
<IfModule mod_headers.c>
|
|
Header always set X-Content-Type-Options "nosniff"
|
|
Header always set X-Frame-Options "DENY"
|
|
Header always set Referrer-Policy "strict-origin-when-cross-origin"
|
|
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
|
|
Header always set Cross-Origin-Opener-Policy "same-origin"
|
|
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
# CSP en observation (ne bloque rien pour l'instant)
|
|
# --- CSP (global) : autorise Matomo + CDNs ---
|
|
Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https: https://staging.uslugi.fr/matomo/; script-src 'self' 'unsafe-inline' https://staging.uslugi.fr/matomo/ https://cdn.jsdelivr.net https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'"
|
|
|
|
</IfModule>
|
|
|
|
# Reduce attack surface
|
|
Options -Indexes -MultiViews
|
|
|
|
# --- Rewrite & HTTPS ---
|
|
RewriteEngine On
|
|
|
|
# Force HTTPS (behind proxy/Varnish)
|
|
RewriteCond %{HTTPS} !=on
|
|
RewriteCond %{HTTP:X-Forwarded-Proto} !https
|
|
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
|
|
|
# Let's Encrypt
|
|
RewriteRule ^\.well-known/acme-challenge/ - [L]
|
|
|
|
# --- Sensitive paths & files ---
|
|
# Block VCS
|
|
RewriteRule ^(\.git|\.svn|\.hg)(/|$) - [F]
|
|
# Block dotfiles (except .well-known)
|
|
RewriteRule ^\.(?!well-known/) - [F]
|
|
# Block sensitive extensions
|
|
RewriteRule \.(env|ini|log|bak|old|sql|zip|tar|gz|7z)$ - [F]
|
|
# Block backup files *~
|
|
RewriteRule ^(.*/)?[^/]+~$ - [F]
|
|
# Block specific filenames
|
|
<FilesMatch "^(config\.php|config\.sample\.php|composer\.json|composer\.lock|package\.json|yarn\.lock)$">
|
|
Require all denied
|
|
</FilesMatch>
|
|
# No scripts in /uploads
|
|
RewriteRule ^(?:public/)?uploads/.*\.(php|phtml|phar|phps|cgi|pl|py|sh|rb)$ - [F,NC]
|
|
|
|
# --- Application routing ---
|
|
# 0) Serve existing files/dirs
|
|
RewriteCond %{REQUEST_FILENAME} -f [OR]
|
|
RewriteCond %{REQUEST_FILENAME} -d
|
|
RewriteRule ^ - [L]
|
|
|
|
# 1) Normalize trailing slash (except /)
|
|
RewriteCond %{REQUEST_URI} !^/$
|
|
RewriteCond %{REQUEST_URI} (.+)/$
|
|
RewriteRule ^ %1 [R=301,L]
|
|
|
|
# 2) Clean URLs -> router.php
|
|
RewriteRule ^([^.]+)$ router.php?slug=$1 [L,QSA]
|
|
|
|
# 2bis) Unknown PHP files => 404
|
|
RewriteCond %{REQUEST_URI} \.php$ [NC]
|
|
RewriteCond %{REQUEST_FILENAME} !-f
|
|
RewriteRule ^ - [R=404,L]
|
|
|
|
# 3) General fallback
|
|
RewriteRule ^ index.php [L,QSA]
|
|
|
|
# --- PWA / Types & SW cache ---
|
|
AddType application/manifest+json .webmanifest
|
|
|
|
<Files "sw.js">
|
|
Header set Cache-Control "no-cache, no-store, must-revalidate"
|
|
Header set Pragma "no-cache"
|
|
Header set Expires "0"
|
|
</Files>
|
|
|
|
# Visio-specific headers for /visio/join.php
|
|
SetEnvIf Request_URI "^/visio/join\.php$" IS_VISIO=1
|
|
|
|
<IfModule mod_headers.c>
|
|
Header always unset Permissions-Policy env=IS_VISIO
|
|
Header always unset Feature-Policy env=IS_VISIO
|
|
Header always set Permissions-Policy "camera=(self 'https://meet.uslugi.fr'), microphone=(self 'https://meet.uslugi.fr'), display-capture=(self 'https://meet.uslugi.fr'), fullscreen=(self 'https://meet.uslugi.fr')" env=IS_VISIO
|
|
Header always set Feature-Policy "camera 'self' https://meet.uslugi.fr; microphone 'self' https://meet.uslugi.fr" env=IS_VISIO
|
|
|
|
Header always set Content-Security-Policy "default-src 'self'; frame-src https://meet.uslugi.fr; script-src 'self' 'unsafe-inline' https://meet.uslugi.fr; connect-src 'self' https://meet.uslugi.fr wss://meet.uslugi.fr; img-src 'self' data: https://meet.uslugi.fr; style-src 'self' 'unsafe-inline' https://meet.uslugi.fr" env=IS_VISIO
|
|
</IfModule>
|
|
|
|
DirectoryIndex index.php index.html
|