Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This is on Apache/2.2.21. In httpd.conf, I had the following directive:

<Location /server-status> 
    SetHandler server-status  
    Order deny,allow  
    Deny from all
    Allow from xx.xx.xxx.xxx                                                                                             <Location> 

I realized recently that my own IP address no longer matched the "Allow from", but still I was able to access server-status! In other words, it was somehow set to be completely public. (I have now disabled it.)

How is this possible? The Location directive is global and my sites are served through vhosts.

Also, what is the best way to configure server-status when I am accessing it from a dynamically-assigned IP address?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Since this is outside of the <VirtualHost> definitions, I'm going to guess that you have Allow all directives inside of the <VirtualHost> blocks.

Sections inside <VirtualHost> sections are applied after the corresponding sections outside the virtual host definition. This allows virtual hosts to override the main server configuration.

See here.

share|improve this answer
1  
Yes, thank you! There was another Location directive in the vhost and I did not realize that location "/" would trump the more specific location "/server-status". –  vortek Jan 20 '12 at 17:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.