When you want to add rewrite rules to your website or web application, you will generally place the various rules in your .htaccess file which OpenLiteSpeed will read in the same way as Apache does. Although, OpenLiteSpeed uses the same syntax as Apache (mod_rewrite) meaning both web servers can follow the same rules there are some slight changes needed to make it compatible. For example, if you wanted to block access xmlrpc.php or wp-trackback.php in Apache you would use these rules in your .htaccess file.
<IfModule mod_rewrite.c> RewriteEngine On RewriteRule ^(xmlrpc\.php|wp-trackback\.php) - [F,L,NC] </IfModule>
With OpenLiteSpeed you will need to amend the rule slightly to achieve the same result and block access to the xmlrpc.php or wp-trackback.php files in your .htaccess file.
RewriteRule ^/(xmlrpc|wp-trackback)\.php - [F,L,NC]
Notice the slight difference in the rewrite rules, Apache will use RewriteRule ^
where OpenLiteSpeed will use RewriteRule ^/
to achieve the same result.
This is due to how the virtualhost configuration works in OpenLiteSpeed. The rewrite rule pattern is initially matched against the URL after the hostname and port but before the query string. As this part of the URL doesn’t end with a forward slash we need to ensure that all rewrite rule patterns in OpenLiteSpeed virtualhost start with a forward slash. The same is true of a rewrite rule pattern in the .htaccess file as well but the other way round. These rewrite rules are matched against the file system path, which does end in a forward slash but doesn’t begin with a forward slash. Therefore, all .htaccess rewrite rules in OpenLiteSpeed must begin their pattern with a forward slash.
Another important difference between OpenLiteSpeed virtualhost configurations and the rewrite rules in a .htaccess file is the RewriteBase directive. This directive is only supported in .htaccess files but if you wanted to use a RewriteBase directive in your OpenLiteSpeed virtualhost configurations you will need to slightly amend the rewrite rule.
The .htaccess RewriteBase directive will look similar to this example.
RewriteBase /joomla RewriteRule .* index.php [F]
In the OpenLiteSpeed virtualhost configuration file the RewriteBase directive will look similar to this example.
RewriteRule /.* /joomla/index.php [F]
In this guide, we will show you how to include rewrite rules globally into all your OpenLiteSpeed virtualhost website configuration files with DirectAdmin.
When using OpenLiteSpeed with DirectAdmin you will have noticed that access to the OpenLiteSpeed admin panel is set to read only and you cannot change or edit any settings using the GUI. The reason for this is due to the way the DirectAdmin integrates OpenLiteSpeed. Usually the OpenLiteSpeed configuration file is one file but DirectAdmin splits this configuration file into multiple include files stored in the /usr/local/lsws/conf
directory. These all come together on the ./build rewrite_confs
command to create one configuration file.
In order to apply global rewrite rules customisations to the OpenLiteSpeed configuration file we will be using a custom OpenLiteSpeed template. In our example we are using the CUSTOM5 location which appears in rewrite{} section of the OpenLiteSpeed Virtualhost file for each domain. The different CUSTOM sections in the OpenLiteSpeed virtualhost file are listed below:
- CUSTOM1: Appears at the very top of the template, before setting the variables.
- CUSTOM2: Appears in the scripthandler{} section.
- CUSTOM3: Appears in the context{} sections.
- CUSTOM4: Appears in the phpIniOverride{} section.
- CUSTOM5: Appears in the rewrite{} section.
- CUSTOM6: Appears in the vhssl{} section.
- CUSTOM7: Appears at the end of the virtualHost.
- CUSTOM8: The very last entry.
Before we can add our rewrite rules customisations globally we will need to create the OpenLiteSpeed CUSTOM5 template file and ensure it it owned by the correct user with the following commands.
cd /usr/local/directadmin/data/templates/custom/ touch openlitespeed_vhost.conf.CUSTOM.5.pre chown diradmin:diradmin openlitespeed_vhost.conf.CUSTOM.5.pre nano openlitespeed_vhost.conf.CUSTOM.5.pre
In the openlitespeed_vhost.conf.CUSTOM.5.pre
file you will need to add your required rewrite rules customisations. In the examples below we have added various WordPress rewrite rules to protect the system files.
RewriteCond %{REQUEST_URI} ^(.*)?readme\.html(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)?readme\.txt(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)?xmlrpc\.php(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)?wp-trackback\.php(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)?license\.txt(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)?wp-config\.php(.*)$ RewriteRule ^(.*)$ - [F,L,NC]
With these rewrite rules activated in the OpenLiteSpeed virtualhost configuration file, anytime someone tries to visit the URL such as https://domain.com/xmlrpc.php they will be presented with a 403 Forbidden error. We can also take it further by protecting other files such as .htaccess or .ini files using the following command.
RewriteRule ^/.*\.(htaccess|htpasswd|ini|log|sh|txt)$ - [F,L,NC]
In the CUSTOM5 template you can also make use use of DirectAdmin template tokens such as |SDOMAIN|
. You could use this token to apply a global 301 redirect to all domains using the following command.
RewriteRule ^/webmail//?(.*)$ https://webmail.|SDOMAIN|//$1 [L,R=301]
Once you have added your rewrite rules customisations you will need to rewrite the existing virtualhost configuration files to include the new rewrite rules using the following command.
cd /usr/local/directadmin/custombuild ./build rewrite_confs
That’s it. You have now successfully added rewrite rules customisations globally into all your OpenLiteSpeed virtualhost website configuration files with DirectAdmin.
7 Comments for How to Add Rewrite Rules with OpenLiteSpeed and DirectAdmin
Thanks a lot! You already saved my life twice 🙂 – the mod security topic for openlitespeed wiith directadmin is stunning too. Really good job! Thanks!
Great post! Keep up the great posts!
Hi Mauro
Thanks for the feedback and glad you found the guide useful.
Kind Regards
VPSBasics
Hello,
Need your help here as well. I’ve applied all rewrite rules specified above and then found ads.txt (that Google and other publishers require) is also blocked and returning 403. Is there anyway to place an exception for this file only and not all *txt?
Hi Ryan
The RewriteRules above won’t block all txt files unless they are called readme, license or start with a dot (.) i.e. .filename.txt. Could you let me know the specific RewriteRule you have used to block all .txt files?
Kind Regards
VPSBasics
Hi,
I think adding the following results all txt blocked for public access.
RewriteRule ^/.*\.(htaccess|htpasswd|ini|log|sh|txt)$ – [F,L,NC]
Could you please help me to get this fixed. Also, applying mod_security and adding rewrite rules (with openlitespeed) result 406 error page. Is there anyway to keep openlitespeed error free while keeping both things activated.
Hi Ryan
I have re-tested the rule and it is working correctly with
ads.txt
returning 200 OK and.ads.txt
returning 403 Forbidden. Also, I have checked for an ads.txt file on the example website you provided before and it returned a 404 Not Found error.I would suggest you remove txt from the rewrite rule or the rule entirely, rebuild config files and then check again. If it still giving you a 403 Forbidden error the problem could be with other rules within ModSecurity such as those provided by Comodo/OWASP. Check through your ModSec logs to find the cause.
Kind Regards
VPSBasics