Security and privacy

Here is the same configuration adapted for Apache 2.4, as we have migrated our server to the newer version of Ubuntu Server (14.04 LTS):

# Deny access to signup.php (email-based self-registration)

# Allow from within Canada (via set variable WhiteList)

# Allow from within 10.x.x.x address space (our learning partners)

# Block from our networks to encourage LDAP authentication instead

# Deny all other access to minimize spam

# For spam bots within whitelisted IP addresses, use the Moodle IP Blocker

<Files signup*>

GeoIPEnable on

SetEnvIf GEOIP_COUNTRY_CODE CA WhiteList

#SetEnvIf GEOIP_COUNTRY_CODE US WhiteList

#Add rules here to allow more countries if desired, see the following for info:

# http://dev.maxmind.com/geoip/legacy/mod_geoip2/

# Apache 2.4 has a new method of access control, see the following:

# http://httpd.apache.org/docs/2.4/upgrading.html

# http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require

# https://blogs.apache.org/httpd/entry/require_and_friends

<RequireAll>

# allow Whitelist (above) or any 10.x.x.x IP address

<RequireAny>

Require env WhiteList

Require ip 10

</RequireAny>

# prevent users on internal networks from new account signup,

# they should use existing LDAP accounts instead!

<RequireNone>

Require ip 10.244.0.0/16

</RequireNone>

</RequireAll>

</Files>