1

I've set up XAMPP on a Windows 7 machine, and I want to restrict access to the htdocs folder to only requests from the local machine. C:\Xampp\htdocs is the web root folder.

I have the following in my apache/conf/httpd.conf file:

<Directory />
    Options FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>


<Directory "C:/Xampp/htdocs">
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All

    order deny,allow
    deny from all
    allow from 127.0.0.1
    allow from localhost
</Directory>

All my .htaccess files are blank.

But when I navigate to the web root folder via a browser, I get the following message:

Access forbidden!

You don't have permission to access the requested directory. There is either no index document or the directory is read-protected.

I tried adding the IP restrictions to the <Directory>...</Directory>, but it made no difference.

What am I doing wrong here?

2 Answers 2

1

You must use the IP address you are accessing the vhost with, and as this server is not currently serving you can easily check the access log to find your IP (XAMPP uses %INSTALL_DIR%\apache\logs\access.log by default).

The IP used to request a vhost is dependent on the IP returned to you by the DNS request. If you're not running a DNS server on your local network then I presume you've added an entry to your hosts file. Mine reads

127.0.0.1       localhost project1 project2 project3

and when I navigate to a project I've hosted locally, my IP appears as 127.0.0.1 in the access.log

5
  • I did the following: [1] Added the hosts entry as above; [2] Navigated to my web root (and got the same error); [3] Looked in the apache access.log file - this is what I saw: zongo - - [02/Jan/2011:15:27:07 -0800] "GET /favicon.ico HTTP/1.1" 403 1174 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10"; [4] Since it looked like the requests were coming from zongo, I added that to the allow from list in the httpd.conf file and saved it; [5] Restarted Apache; [6] Nav'd to the webroot, but got the same error. Jan 2, 2011 at 23:31
  • OK, I changed l27.0.0.1 localhost to 127.0.0.1 localhost zongo, and that's fixed the problem. Thanks for the suggestion! Jan 2, 2011 at 23:43
  • Glad you're up and running! Using a hostname is not very secure, although for your needs it may be sufficient. I'd recommend changing the logformat httpd.apache.org/docs/current/mod/… see IPs and using an IP instead.
    – Andy
    Jan 3, 2011 at 0:20
  • Just to clarify, Andy, are you saying that [1] it's not secure to use a hostname to restrict access, as I have done in httpd.conf, or [2] it's not secure to have a hostname logged in my access.log file? Jan 3, 2011 at 1:08
  • It's preferable to have an IP in your access log (see logformat link) as it's easier to masquerade behind a hostname, and using a host to restrict access is less secure than an IP because the IP is more likely to be static (although that's not guaranteed either!)
    – Andy
    Jan 3, 2011 at 13:37
1

You are not accessing the server using the localhost or 127.0.0.1 addresses. You will be using the ip address of the local machine - add that to your allow from directive. If your local machine IP address is 192.168.1.183 then you would use

allow from 192.168.1.183
3
  • I tried adding the ip address that I obtained from going to a site like whatsmyip.org, but that didn't work. I also tried the ip address I got when I pinged my machine name, but that didn't work either. Jan 2, 2011 at 22:14
  • If you are behind nat, then whatsmyip.org won't help you. Open a command prompt and type 'ipconfig /all'. Then find the address of your network interface.
    – blueben
    Jan 2, 2011 at 22:59
  • @Blueben, the IP address from ipconfig /all is the same IP address I got back from a ping. I have tried that, and it doesn't work. Jan 2, 2011 at 23:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .