Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just upgraded Apache from it's 2003 build, to a squeaky-clean, brand-new 2.4.1 build. All seems pretty good except for one glaring thing:

In my httpd.conf file I have the following:

<Directory />
    AllowOverride none
    Options FollowSymLinks
    AuthType      Basic
    AuthName      "Enter Password"
    AuthUserFile  /var/www/.htpasswd
    Require     valid-user
</Directory>

This should allow only users in the specified auth file to access the server - just as it had under the older version of Apache. (Right?)

However, it's not working. Requests are granted with no authentication provided. When I switch logging to LogLevel Debug, for the accesses, it says:

[Sat Mar 24 21:32:00.585139 2012] [authz_core:debug] [pid 10733:tid 32771] mod_authz_core.c(783): [client 192.168.1.181:57677] AH01626: authorization result of Require all granted: granted
[Sat Mar 24 21:32:00.585446 2012] [authz_core:debug] [pid 10733:tid 32771] mod_authz_core.c(783): [client 192.168.1.181:57677] AH01626: authorization result of <RequireAny>: granted

I really don't know what this means - and I (to the best of my knowledge) don't have any "Require all granted" or "" statements in any of my files.

Any ideas why this isn't working, or where to debug??

UPDATE:

I have a virtualhost on the SSL port which allows proxying. When I put the same entries inside the

<proxy *> 

clause in the virtualhost config, it works. It doesn't seem to work in the

 <Directory> 

clause. I then tried putting under other Directory clauses (specific for other directories) and that didn't work either.

ALSO

From Shane's questions below - I tried duplicating the root "/" block to a "/tmp" directory. The /tmp directory works CORRECTLY!! So - this problem is specific to the root directory only???

share|improve this question
1  
What other <Directory> blocks do you have applying to the requests that aren't working? –  Shane Madden Mar 25 '12 at 23:10
    
I just put one for the root "/" directory, which should apply to the entire server. I have tried adding one to the user home directory (per mod_userdir) and had the same results with that. –  Brad Mar 26 '12 at 0:03
    
@ShaneMadden - on your question - I tried duplicating the root "/" block to a "/tmp" directory. The /tmp directory works CORRECTLY!! So - this problem is specific to the root directory only??? –  Brad Mar 26 '12 at 0:09
    
I suspect that there's a more-specific <Directory> block elsewhere in your Apache config that's taking precedence over the one that you've set for /. –  Shane Madden Mar 26 '12 at 0:16
    
I just grepped everything - nothing. These config files were very minimal modifications to Apache's newly-installed defaults. –  Brad Mar 26 '12 at 0:29

3 Answers 3

up vote 3 down vote accepted

I had a similar problem with Digest authentication on a fresh 2.4 install. Looking closely at the documentation on Apache's site, it looks like the authentication directives need to be in a <Location> tag rather than a <Directory> tag. See the documentation for the AuthBasicProvider directive.

share|improve this answer
    
Thanks! That was it!! –  Brad Apr 28 '12 at 23:03

You appear to be missing a provider for AuthBasic. Try adding a line like:

AuthBasicProvider    file

Once you have this working you may want to look at the Satisfy directive. This can be used to allow local access without a password, while requiring a password for Internet access.

EDIT: I user an include file for BasicAuth to enable password basedd remote access to content which is normally not available from the Internet. You may not want the Satisfy directive. This is my /etc/apache2/basicauth.conf file:

# Basic authorization configuration include file 
# Enable basic auth access for remote users
AuthName             "Authentication Required"
AuthType             Basic
AuthBasicProvider    file
AuthUserFile         /etc/apache2/httpd.passwd
Require              valid-user
Satisfy              any

I also have an /etc/apache2/allow_local.conf include file for IP based authentication.

# Common local access block - Allow all local addresses
Order deny,allow
Deny  from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
Allow from 192.168.1.0/24

To enable them I use these includes.

Include /etc/apache2/allow_local.conf
Include /etc/apache2/basicauth.conf

You may want to try adding to to authorization specification. This works with my test configuration.

Order deny,allow
Allow from all
share|improve this answer
    
Tried it - still doesn't work :-O –  Brad Mar 25 '12 at 15:08
    
If I just include your files as-is, I get an error: "AuthName not allowed here" - as you can't specify these directives anywhere (like outside a "Location", "Directory", or "Proxy" clause. Or am I missing something? If I do include it inside the "Directory" clause - again - I am let in without any credentials. –  Brad Mar 25 '12 at 20:39
    
If I only put a "deny from all" in the "directory" clause, I am denied access (as you'd expect). If then include your FIRST script in the directory clause, I am unconditionally allowed access. If I remove the "satisfy" in your script, I am unconditionally denied. –  Brad Mar 25 '12 at 20:50

sorry, the previous post got changed by the html renderer... Should have said:

... the authentication directives need to be in a < Location > tag, rather than a < Directory > tag...

-Chris

share|improve this answer
    
You may edit your own posts. Please remove the duplicate and edit the original. –  jscott Apr 27 '12 at 19:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.