Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have tried reading the manual although to be honest I am still finding it hard to understand and get my head around what the Order/Allow actually does and what should be the default settings for web server.

I have the following default config, where I have turned off .htaccess and symbolic links.

Although I am not really sure what the Order Allow,Deny and Allow from all actually does? Should I change this to Allow from 127.0.0.1?

<Directory />
Options -Indexes -FollowSymLinks MultiViews
AllowOverride None
Order Allow,Deny
Allow from all
</Directory>

Additionally do I need the below <Files> or is there a better way of writing this for apache?

<Directory /var/www/example/subdomains/dev/public/webapp>
    RewriteEngine Off

    <Files *>
        order allow,deny
        deny from all
    </Files>
    <FilesMatch "\.(png|gif|jpe?g|png|css|js|swf|ps|flv)$">
        order allow,deny
        allow from all
    </FilesMatch>
</Directory>
share|improve this question

1 Answer 1

up vote 7 down vote accepted

Order Allow,Deny means that the Allow rules are processed before the Deny rules. If client doesn't match the Allow rules or it does match the Deny rule, it will be denied access.

So,

Order Allow,Deny
Allow from all

means that any client can access to your web server.

I want to turn off .htaccess and symbolic links.

You already did that with AllowOverride None and Options -FollowSymLinks

<Directory /var/www/example/subdomains/dev/public/webapp>
    RewriteEngine Off

    <Files *>
        order allow,deny
        deny from all
    </Files>
    <FilesMatch "\.(png|gif|jpe?g|png|css|js|swf|ps|flv)$">
        order allow,deny
        allow from all
    </FilesMatch>
</Directory>

This config did the following:

  • disable rewriting engine
  • client will be denied access to the all files in webapp folder except for images, js, swf, ...

Pay attention to:

order allow,deny
deny from all

it tells Apache to deny any access.

share|improve this answer
    
Thanks quanta, it is now a lot clearer. Although what are the rules you speak about for the allow/deny? –  John Magnolia Sep 12 '11 at 19:07
    
I mean Deny from <address> and Allow from <hostname> are rules. –  quanta Sep 13 '11 at 2:52
    
Fully understand now, thank you –  John Magnolia Sep 13 '11 at 7:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.