Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an admin directory on my web server (http://test.com/admin) and I don't want unauthorized parties to access this /admin/ directory instead I want to return 404 error code for all unauthorized accesses.

My question is, is there any way to return 404 error code for all access attempts except a few specific IP addresses?

My web server is Apache on Linux (plesk).

share|improve this question
    
Presumably you're choosing to deliberately hide the resource rather than return a 403? –  annakata May 27 '09 at 15:20
3  
+1 for ironic username. –  TheTXI May 27 '09 at 15:21

3 Answers 3

up vote 4 down vote accepted

Well, close:

<Location /admin>
     Order deny,allow
     Allow from 10.0.0.1
     Allow from 192.168.1.1
     Deny from all
</Location>

Though what this actually does is return a 403 Forbidden, not a 404 Not Found, which is, y'know, correct.

If you're putting this in a .htaccess in the admin directory, you don't need the Location container. The example is written for a server or virtual host configuration file.

See also mod_access docs.

For what it's worth, as time has worn on I've increasingly come to find value in putting the site admin on an entirely separate virtual host.

share|improve this answer

check the "allow from" attribute in the configuration guide

share|improve this answer

You can use mod_rewrite to do that.

RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=10.0.0.1 [OR]
RewriteCond %{REMOTE_ADDR} !=10.0.0.1
RewriteRule ^admin($|/) - [L,R=404]

Note that the R=404 flag requires at least Apache 2.1.1.

share|improve this answer
    
This is brilliant for properly hiding .htaccess, etc., not to mention WEB-INF when fronting for a servlet container and keeping everything in the same source directory. Cheers! –  T.J. Crowder Oct 13 '09 at 11:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.