Restricting website access¶

Procedure¶

To include this functionality, complete the following steps:

1. In a command prompt window, edit your website’s settings.php file (located by default in docroot/sites/default/).

2. Add the following code to the end of the file:

   if(!defined('DRUPAL_ROOT')) {
   define('DRUPAL_ROOT', getcwd());
   }
   if (file_exists(DRUPAL_ROOT . '/sites/acquia.inc')) {
   require DRUPAL_ROOT . '/sites/acquia.inc';
   }
   

3. Save your changes to the settings.php file.

4. In the docroot/sites/ directory create a file called acquia.inc. You can download a sample acquia.inc file for your use on a Drupal 7 website. A Markdown file with examples and explanations of the code contained in this file is also available.

   For Drupal 8 websites

   The ip_address() function included in the sample acquia.inc file is incompatible with Drupal 8. Acquia recommends using a contributed module to reproduce this functionality, such as the Restrict IP module.

Contact Acquia Support to obtain a list of Acquia IP addresses for whitelisting in your acquia.inc file.

Redirecting users outside an IP address range¶

In a non-Acquia hosting environment, you can use the %{REMOTE_ADDR} variable in the .htaccess file to redirect users to Google if they are not in the 123.456.* IP address range. This does not work on Acquia Cloud, however, because of its load balancing structure.

To accomplish the redirect on Acquia Cloud, use the %{ENV:AH_Client_IP} variable:

RewriteCond %{ENV:AH_Client_IP} !^123\.456\..*
RewriteRule ^http://www.google.com [R=307,L]

For more information about blocking with .htaccess and rewrites, see Blocking access using rewrites.

Blocking by IP¶

Because Acquia Cloud uses Varnish® and load balancers, typical access controls will not work correctly. This method is similar to the one detailed in Best practices on setting up an edit domain. You can use a combination of an environment variable that is present on your Acquia Cloud server, AH_Client_IP, and Apache’s mod_setenvif.

You should ensure that these rules are in the section that determines that the Apache mod_rewrite module is enabled; if it is not, these redirects will fail.

If you need to block a single IP, the following example sets an environment variable on the specific IP address 192.168.15.20, using mod_setenvif.

<ifmodule mod_setenvif.c>
SetEnvIf AH_CLIENT_IP ^192\.168\.15\.20$ DENY=1
Order allow,deny
Allow From All
Deny from env=DENY
</ifmodule>

If you need to block multiple IPs, the following example blocks addresses from the group 104.128.*.* and the IP address 192.168.10.10. We are then able to specifically deny access to these two subnets and allow access to all other IPs.

<ifmodule mod_setenvif.c>
# Match all IP addresses beginning with 104.128
SetEnvIf AH_CLIENT_IP ^104\.128\. Deny_Host
# Match a specific IP address
SetEnvIf AH_CLIENT_IP ^192\.168\.10\.10$ Deny_Host
Order allow,deny
Allow from all
Deny from env=Deny_Host
</ifmodule>

All IPs in the 104.128 subnet and the IP address 192.168.10.10 get a DENY header. The rewrite rules check for allowed, and then deny everyone with a DENY header.

To restrict access and allow only certain IP addresses to reach a website, you can use code similar to the following:

<ifmodule mod_setenvif.c>
# Match all IP addresses beginning with 104.128
SetEnvIf AH_CLIENT_IP ^104\.128\.
Allow_Host
# Match a specific IP address
SetEnvIf AH_CLIENT_IP ^192\.168\.10\.10$ Allow_Host
Order deny,allow
Deny from all
Allow from env=Allow_Host
</ifmodule>

The immediately previous code is the opposite of the first example, by using the ALLOW header to give only certain groups access to the website, instead of denying those groups.

Using XFF headers to block by IP¶

If blocking by IP in .htaccess using AH_Client_IP does not work, you can use the X-Forwarded-For header. The following example includes this header in the blocking rules in .htaccess:

<ifmodule mod_setenvif.c>
SetEnvIf AH_CLIENT_IP ^123\.234\.123\.234$ DENY=1
SetEnvIf X-Forwarded-For 123\.234\.123\.234 DENY=1
Order allow,deny
Allow From All
Deny from env=DENY
</ifmodule>

XFF headers use a pattern match without the ^ and $ anchors—if the IP address appears anywhere in the value of XFF header, the request will be blocked. This method may generate false positives, especially when using patterns to block entire subnets, such as 123.234.

However, if everything works as it should (assuming an attacker is not spoofing IP addresses), the actual source IP should typically appear in the XFF header. Note that you cannot be sure of the IP address’ position, as its position can vary depending on the proxy’s or balancers’ setup.