Apache2 “Deny from all” directive in 'security' section stops access in Virtual Host sections

Question

I have the following two sections in my agache2.conf file.

<Directory />
    Options FollowSymLinks +Indexes
    AllowOverride None
    Order allow,deny
    Deny from all
</Directory>

and

<VirtualHost *:80>
DocumentRoot "/home/bernie/development/public2"
ServerName myfl2.local
  <Directory /home/aaaa/development/public2>
    AllowOverride None
    #Options FollowSymLinks +Indexes
    Order allow,deny
    Allow from all
  </Directory>
</VirtualHost>

The following file exists with some content:

/home/bernie/development/public2/a/a/index.html

For some reason, trying to access

myfl2.local/a/a/index.html

I get a "403 Forbidden" error. I've narrowed the problem down to the line "Deny from all" in the first directory section above, but I can't figure out how to keep that (as it's a very important directive) and allow access to public2/a/a directory. Anyone have any idea how to fix that?

Answer 1

You have two options that I can think of. One is to create a separate directory directive. The other is to do the following:

Above the directory directive:

SetEnvIf Request_URI "/public2/a/a/*" publicaccess

Within the directory directive:

Allow from env=publicaccess

Although, I'm curious: what's the point of a directory that's only Deny all?

Answer 2

The Order setting is the key here. The /home/aaaa/development/public2 directory has both an Allow from all and Deny from all directive associated, and the Order is set to allow,deny. This means that a deny command is always going to take precedence over an allow command.

Changing the Order directive in the more specific block should solve the problem. Another option would be to take out the explicit Deny from all in the block for /; when the order is allow,deny then no request will be allowed without an explicit Allow.