Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

One of our publicly reachable web servers is restricting access to all of itself using a <Location /> block.

I have a particular directory that needs stricter access restrictions than provided by <Location />.

However, using <Directory /path/to/dir> is not possible, as <Directory> is overwritten by <Location>.

What can I do to restrict access to a specific directory while maintaining a less strict access restriction on the whole web server?

It is not possible to change <Location /> to <Directory /path/to/docroot> as this Apache is acting as a reverse proxy for a lot of other web servers on internal servers that cannot be directly reached from outside the network.


By request, a little detail about our configuration:

All of our authorization and authentication is done with LDAP.

Since this Apache is acting as a reverse proxy for a lot of internal web servers we need to restrict access to all of it:

<Location />
     Order deny,allow
     Deny from all
     AuthName [...]
     AuthType Basic
     AuthLDAPURL [...]
     AuthBasicProvider ldap
     Require ldap-attribute [...]
</Location>

A particular directory under the document root needs stricter access permissions. Therefore I thought of this:

<Directory /path/to/dir>
    Order allow,deny
    AuthName [...]
    AuthType Basic
    AuthLDAPURL [...]
    AuthBasicProvider ldap
    Require ldap-attribute [...]
    Require ldap-attribute [...]
    Require ldap-attribute [...]
</Directory>

However, this doesn't work as <Location> sections are merged after <Directory> sections (see here).

So even though I have written a <Directory> section for the directory that I want to have stricter access permissions for the directives are overwritten by the ones in <Location />, allowing access to more users than desired.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

How about using <Location /location/to/restrict/>?

Anyway, they don't "overwrite", per se; they merge. For more info, see here.

You can still use <Directory> if you're careful about what's going to get merged. <Location> applies last, but if it's not specifying any access controls, it's not going to nullify what you've got in <Directory>.

Order deny,allow
<Location />
    # No permission settings here; no allow or deny.
    # Will be allowed by default because of the Order.
    ...
</Location>
<Directory /location/to/restrict/>
    Deny from all
    Allow from 10.0.0.0/8
    ...
</Directory>
share|improve this answer
    
This Apache acts as a reverse proxy for a lot of web servers on other, internal servers. Therefore, there has to be an access restriction on the whole server. So <Location /> has to contain permission settings. –  Legate Apr 8 '11 at 20:59
    
@Legate What does it need to contain? If you're unable to use my first suggestion (<Location /location/to/restrict/>, which would be a lot simpler than revamping all of your permissions), there is likely a way to make the merge give you the permission set that you require; the <Location /> block in my example can still be set to control permissions if configured correctly. It would be better if you could provide the relevant parts of the config in your question. –  Shane Madden Apr 8 '11 at 21:06
    
@Shane Madden: Done, see question. –  Legate Apr 9 '11 at 11:51
    
@Legate Hmm. It'd be doable with just the host allow/denies (change the Order block in the <Location> to allow,deny and restructure everything on down), but the change to the LDAP stuff makes this.. difficult. Are you completely sure you couldn't simply use a more specific <Location> block to restrict the subdirectory (turning off symlinks if needed)? –  Shane Madden Apr 9 '11 at 18:33
    
@Shane Madden: Yes, it would be possible to use a <Location> block. However, the Apache documentation clearly states: "It is important to never use <Location> when trying to restrict access to objects in the filesystem.". I was trying to follow this advice, but if it is not possible I'll have to live with that. –  Legate Apr 9 '11 at 19:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.