Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following two sections in my agache2.conf file.

<Directory />
    Options FollowSymLinks +Indexes
    AllowOverride None
    Order allow,deny
    Deny from all


<VirtualHost *:80>
DocumentRoot "/home/bernie/development/public2"
ServerName myfl2.local
  <Directory /home/aaaa/development/public2>
    AllowOverride None
    #Options FollowSymLinks +Indexes
    Order allow,deny
    Allow from all

The following file exists with some content:


For some reason, trying to access


I get a "403 Forbidden" error. I've narrowed the problem down to the line "Deny from all" in the first directory section above, but I can't figure out how to keep that (as it's a very important directive) and allow access to public2/a/a directory. Anyone have any idea how to fix that?

share|improve this question

You have two options that I can think of. One is to create a separate directory directive. The other is to do the following:

Above the directory directive:

SetEnvIf Request_URI "/public2/a/a/*" publicaccess

Within the directory directive:

Allow from env=publicaccess

Although, I'm curious: what's the point of a directory that's only Deny all?

share|improve this answer
I've seen a lot of sites where <Directory /> is Deny from all and then specific directories are overridden to allow access -- Not sure how much extra security it buys, but it's an option :) – voretaq7 Mar 17 '11 at 16:02
I could see that. I'm not saying it's wrong, just that I was curious about the reasoning :-) – Hyppy Mar 17 '11 at 16:23

The Order setting is the key here. The /home/aaaa/development/public2 directory has both an Allow from all and Deny from all directive associated, and the Order is set to allow,deny. This means that a deny command is always going to take precedence over an allow command.

Changing the Order directive in the more specific block should solve the problem. Another option would be to take out the explicit Deny from all in the block for /; when the order is allow,deny then no request will be allowed without an explicit Allow.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.