Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

How can I make it that my local Apache installation works only as http://localhost/ and never from outside like using the IP of my machine when connected to a network please?

share|improve this question

4 Answers

up vote 2 down vote accepted

Could try:
order deny,allow
allow from 127.0.0.1
deny from all
in a .htaccess file. - I use a similar setup to allow an external website to allow all access from our office IP, but ask for a password from any other.

share|improve this answer
Hm, I'll give that a go. I suppose I can set the root to only take localhost and set all for allow if I want to allow acces to /myfolder/ ? – Francisc Mar 30 '11 at 18:47
1  
I just tried that and it worked for a sub-folder. – Chris Kaufmann Mar 30 '11 at 19:01
I've written this in the .htaccess and it's giving a 500. <Directory "/"> Order deny,allow Deny from all Allow from 127.0.0.1 </Directory> – Francisc Mar 30 '11 at 19:13
1  
@Francisc : Look for the error in the ErrorLog. That may provide more information on why you are receiving a 500 error. – Stefan Lasiewski Mar 31 '11 at 18:19
1  
I'm no expert on .htaccess, but not sure you need the <Directory> directives at all. Should work recursively without it. – Chris Kaufmann Mar 31 '11 at 18:21
show 2 more comments
up vote 2 down vote

Change your current "Listen" line to "Listen 127.0.0.1:80"

http://httpd.apache.org/docs/current/mod/mpm_common.html#listen

share|improve this answer
Can I add that in an .htaccess file? If so, can it just be used for some folders to allow access to some and in the root htdocs to disallow all? – Francisc Mar 30 '11 at 18:23
No thats a for-the-whole-server setting. What it does is tell the server to only even allow connections from localhost. – cagenut Mar 30 '11 at 18:34
How could I do that folder based so to speak. And just move or copy the .htaccess where I want. – Francisc Mar 30 '11 at 18:40
up vote 1 down vote

The easiest way would be to block ports 80 and 443 in the firewall for the machine that is hosting Apache. This would make external requests get blocked at the firewall.

share|improve this answer
1  
That would work, but I'd much rather do it by .htaccess or httpd.conf if possible so that it's easier to allows / disallow people or even just allow some folders at given times etc. – Francisc Mar 30 '11 at 18:20
1  
@Francisc : Doing this in httpd.conf will also provide an additional layer of protection in case iptables are accidentally disabled or mangled. You should still use iptables regardless, because then you have explicit control over which ports are open to the outside. – Stefan Lasiewski Mar 30 '11 at 19:05
I see. And it's a fair point, but when I need someone on the network to take a look and give him a link I don't want to have to ask him for his IP. The .htaccess solution would be ideal for my particular case. – Francisc Mar 30 '11 at 19:07
up vote 1 down vote

Some of this is borrowed from httpd.apache.org/docs/2.2/misc/security_tips.htm.

Add the following to httpd.conf :

  1. Restrict access to everything by default. This is from "Protect Server Files by Default":

    <Directory /> 
Order Deny,Allow 
Deny from all 
</Directory>

  2. Then, allow access only in those areas you wish. In this example, /var/www/html is my DocumentRoot: 

    DocumentRoot "/var/www/html"
<Directory /var/www/html/> 
Order Deny,Allow 
Allow from 127.0.0.1 
</Directory>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.