How to block access to xmlrpc.php for ALL USERS using OpenLitespeed ?

remics

Verified User
Joined
Aug 6, 2019
Messages
30

How could I generate a virtual host to apply this setting for ALL USERS?
 

jamgames2

Verified User
Joined
Aug 16, 2019
Messages
437
I don't know how openlitespeed token, so you need to find it yourself

this solution for apache

If you want to place some coding into <virtualhost> tag
I reply about how to put to custom template file on this link


add this to "CUSTOM3" token
Code:
<FilesMatch "^(xmlrpc\.php|wp-trackback\.php)">
Order Deny,Allow
Deny from all
</FilesMatch>

and do some rewrite_confs
Code:
cd /usr/local/directadmin/custombuild
./build rewrite_confs



###UPDATE FOR OpenLiteSpeed Token
 
Last edited:

remics

Verified User
Joined
Aug 6, 2019
Messages
30
I understand this should be super simple for most people but I created this thread with the goal of asking what are the exact steps I need to take as I really couldn't understand the documentation.

The title is well written and I believe this is a common use case so I hope someone is available to help me and others with this problem.
 

Richard G

Verified User
Joined
Jul 6, 2008
Messages
6,754
Location
Maastricht
I don't know OLS. But it looks like the same as in apache, only other files.
Look at this:
related to this:

Seems to me it's for OLS the same, just you have to use the CUSTOM.1.post or CUSTOM.7.post if I'm not mistaken.
 

LeonDynamic

Verified User
Joined
Sep 19, 2020
Messages
32

How could I generate a virtual host to apply this setting for ALL USERS?
If you follow these instructions it will add a rewrite rule into all user VHost files to block access to xmlrpc.

Code:
cd /usr/local/directadmin/data/templates/custom/
touch cust_openlitespeed.CUSTOM.5.pre
chown diradmin:diradmin cust_openlitespeed.CUSTOM.5.pre
nano /usr/local/directadmin/data/templates/custom/cust_openlitespeed.CUSTOM.5.pre

Then inside the CUSTOM.5.pre file you can paste the following RewriteRule.

Code:
RewriteCond %{REQUEST_URI} ^(.*)?xmlrpc\.php(.*)$ [OR]
RewriteRule ^(.*)$ - [F,L,NC]

If you wanted to take this a bit further and block access to more files system wide and apply to each VHost you can add as many filenames to list as you want.
Code:
RewriteCond %{REQUEST_URI} ^(.*)?readme\.html(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?readme\.txt(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?xmlrpc\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-trackback\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?license\.txt(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-config\.php(.*)$
RewriteRule ^(.*)$ - [F,L,NC]
 

remics

Verified User
Joined
Aug 6, 2019
Messages
30
If you follow these instructions it will add a rewrite rule into all user VHost files to block access to xmlrpc.

Code:
cd /usr/local/directadmin/data/templates/custom/
touch cust_openlitespeed.CUSTOM.5.pre
chown diradmin:diradmin cust_openlitespeed.CUSTOM.5.pre
nano /usr/local/directadmin/data/templates/custom/cust_openlitespeed.CUSTOM.5.pre

Then inside the CUSTOM.5.pre file you can paste the following RewriteRule.

Code:
RewriteCond %{REQUEST_URI} ^(.*)?xmlrpc\.php(.*)$ [OR]
RewriteRule ^(.*)$ - [F,L,NC]

If you wanted to take this a bit further and block access to more files system wide and apply to each VHost you can add as many filenames to list as you want.
Code:
RewriteCond %{REQUEST_URI} ^(.*)?readme\.html(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?readme\.txt(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?xmlrpc\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-trackback\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?license\.txt(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-config\.php(.*)$
RewriteRule ^(.*)$ - [F,L,NC]

Thank you so much!

I hope it helps other people as well as helping me.

However, when executing the above commands I had the problem of all pages being blocked with error 403 (forbidden). I don't know what I did wrong but here are the exact steps I took:

Code:
vim /usr/local/directadmin/data/templates/custom/cust_openlitespeed.CUSTOM.5.pre

put the following content in this file:
Code:
RewriteRule ^/(xmlrpc|wp-trackback)\.php - [F,L,NC]
(no BREAK LINE, please)

Code:
cd /usr/local/directadmin/custombuild
./build rewrite_confs

Reference Link: https://openlitespeed.org/kb/customization-hooks-in-directadmin/
 
Last edited:

LeonDynamic

Verified User
Joined
Sep 19, 2020
Messages
32
Thank you so much!

I hope it helps other people as well as helping me. I've followed all the steps here and actually confirmed that it works, however after creating these files the next step is to run the following commands:
Code:
cd /usr/local/directadmin/custombuild
./build rewrite_confs
Thanks @remics for adding the rewrite config command forgot to add that to my reply.

Also, have a look here https://www.vpsbasics.com/cp/ there are quite a few tutorials for OLS with DirectAdmin
 
Top