Apache2: how to restrict access to files in DocumentRoot

Question

I have written this config for restrict access to /var/www/news.html:

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/

    <Directory /var/www/>
        Order deny,allow
        Allow from all
        Options FollowSymLinks
    </Directory>

    <Files /var/www/news.hmtl>
        Order allow,deny
        Deny from all
    </Files>
</VirtualHost>

But it example.com/news.html still opens. I've solved this by explicit restrict access to URL example.com/news.html:

<Location /news.html>
    Order allow,deny
    Deny from all
</Location>

It seems like all <Directory> and <Files> rules are overriden by some implicit <Location> when resolving URL to path relative DocumentRoot. Is it a true and I should think about DocumentRoot like about a place which proposed to be public visible?

Answer 1

The Files directive doesn't take a path - change your files block like so.

<Files news.hmtl>
    Order allow,deny
    Deny from all
</Files>

The above would work but may not do exactly what you want as any and all files named news.html within the whole vhost filesystem would be blocked. You can limit the scope of the Files directive by wrapping it in a Directory directive

<Directory /var/www/test>
    Order deny,allow
    Allow from all
    Options FollowSymLinks
    <Files news.hmtl>
        Order allow,deny
        Deny from all
    </Files>
</Directory>

Now files called news.html within the /var/www/testdirectory and all of it's subdirectories would be blocked.

Have a look at the Filesystem and Webspace section of the Apache docs for more information on how these directives interact.