'How to only allow certain user agents through mod security's WAF?

I'm very new to all of this so I'm kinda stuck... How would I restrict access to my server to a limited amount of user agents (using mod security)? Also how would I apply this rule to just a single port? Thank you.

linuxfirewallmod-securityweb-application-firewall


Solution 1:[1]

try this rule (replace user_agent_1/2/.. with allowed User-Agents [identify every by a single word, for example Googlebot]):

SecRule REQUEST_HEADERS:User-Agent "!@pm user_agent_1 user_agent_2" \
    "id:100,\
    phase:1,\
    deny,\
    t:none,\
    logdata:'Blocking User-Agent: %{MATCHED_VAR}'"

What do you mean by a 'port'?

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 azurit

Related Questions