Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've set up XAMPP on a Windows 7 machine, and I want to restrict access to the htdocs folder to only requests from the local machine. C:\Xampp\htdocs is the web root folder.

I have the following in my apache/conf/httpd.conf file:

<Directory />
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>


<Directory "C:/Xampp/htdocs">
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All

    order deny,allow
    deny from all
    allow from 127.0.0.1
    allow from localhost
</Directory>

All my .htaccess files are blank.

But when I navigate to the web root folder via a browser, I get the following message:

Access forbidden!

You don't have permission to access the requested directory. There is either no index document or the directory is read-protected.

I tried adding the IP restrictions to the <Directory>...</Directory>, but it made no difference.

What am I doing wrong here?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You must use the IP address you are accessing the vhost with, and as this server is not currently serving you can easily check the access log to find your IP (XAMPP uses %INSTALL_DIR%\apache\logs\access.log by default).

The IP used to request a vhost is dependent on the IP returned to you by the DNS request. If you're not running a DNS server on your local network then I presume you've added an entry to your hosts file. Mine reads

127.0.0.1       localhost project1 project2 project3

and when I navigate to a project I've hosted locally, my IP appears as 127.0.0.1 in the access.log

share|improve this answer
    
I did the following: [1] Added the hosts entry as above; [2] Navigated to my web root (and got the same error); [3] Looked in the apache access.log file - this is what I saw: zongo - - [02/Jan/2011:15:27:07 -0800] "GET /favicon.ico HTTP/1.1" 403 1174 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"; [4] Since it looked like the requests were coming from zongo, I added that to the allow from list in the httpd.conf file and saved it; [5] Restarted Apache; [6] Nav'd to the webroot, but got the same error. –  Tola Odejayi Jan 2 '11 at 23:31
    
OK, I changed l27.0.0.1 localhost to 127.0.0.1 localhost zongo, and that's fixed the problem. Thanks for the suggestion! –  Tola Odejayi Jan 2 '11 at 23:43
    
Glad you're up and running! Using a hostname is not very secure, although for your needs it may be sufficient. I'd recommend changing the logformat httpd.apache.org/docs/current/mod/… see IPs and using an IP instead. –  Andy Jan 3 '11 at 0:20
    
Just to clarify, Andy, are you saying that [1] it's not secure to use a hostname to restrict access, as I have done in httpd.conf, or [2] it's not secure to have a hostname logged in my access.log file? –  Tola Odejayi Jan 3 '11 at 1:08
    
It's preferable to have an IP in your access log (see logformat link) as it's easier to masquerade behind a hostname, and using a host to restrict access is less secure than an IP because the IP is more likely to be static (although that's not guaranteed either!) –  Andy Jan 3 '11 at 13:37

You are not accessing the server using the localhost or 127.0.0.1 addresses. You will be using the ip address of the local machine - add that to your allow from directive. If your local machine IP address is 192.168.1.183 then you would use

allow from 192.168.1.183
share|improve this answer
    
I tried adding the ip address that I obtained from going to a site like whatsmyip.org, but that didn't work. I also tried the ip address I got when I pinged my machine name, but that didn't work either. –  Tola Odejayi Jan 2 '11 at 22:14
    
If you are behind nat, then whatsmyip.org won't help you. Open a command prompt and type 'ipconfig /all'. Then find the address of your network interface. –  blueben Jan 2 '11 at 22:59
    
@Blueben, the IP address from ipconfig /all is the same IP address I got back from a ping. I have tried that, and it doesn't work. –  Tola Odejayi Jan 2 '11 at 23:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.