Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When using the following, I am having a problem blocking all access from unlisted IPs:

<Directory />
    Order allow,deny
    Allow from 192.168.100.10
    Options -MultiViews
    AllowOverride All
</Directory>

When at any host other than 192.168.100.10, and I hit the ServerName (which serves DocumentRoot /var/www/website), I am fed the ./error/noindex.html page, not the Forbidden page.

Note that on the ErrorLog I see:

Wed May 16 22:08:46 2012] [error] [client 192.168.100.11] client denied by server configuration: /var/www/website/

Interestingly, when I hit http://ServerName/website on a blocked server, I do see the Forbidden page. When I hit http://ServerName/website on the allowed host, I see Not Found.

What is wrong with the configuration?

I wish to deny all to the root, except for the specific listed address.

Thanks.

[edit] vhost config: http://pastebin.com/ucziGF4Q

share|improve this question
    
Can you provide the virtual host's full configuration? –  Shane Madden May 16 '12 at 19:35
    
Thanks Shane. Note the file containing this vhost is Included in the main httpd.conf pastebin.com/ucziGF4Q –  mbrownnyc May 16 '12 at 19:43
1  
Hmm.. I wonder if some configuration elsewhere is conflicting. As a test, can you move the contents of your <Directory /> block into a <Location /> block, and see if the behavior changes then? –  Shane Madden May 16 '12 at 20:34
    
Thanks again Shane. I simply replaced the <Directory /> with <Location />, and it worked! It appears that Location is a lot different than Directory. Why would the Directory directive not work to do this job? –  mbrownnyc May 17 '12 at 13:34
1  
I believe there's other config elsewhere that's taking precedence over your <Directory /> configuration; <Location> is the last section applied in the configuration merge process, so it can't be overridden from elsewhere. See here. –  Shane Madden May 17 '12 at 15:17
show 1 more comment

1 Answer

Your DocumentRoot (called wwwdata or htdocs) directory is /var/www/website, so you must specify allow/deny for that directory, not root.

<Directory /var/www/website>
    Order deny,allow
    Deny from all
    Allow from 192.168.100.10 192.168.100.11 192.168.100.12
</Directory>

Why you specifying custom access policy for sytem root dir and expecting it inheritance to vhost data root?

BTW if you really must to set up rights to system root, then in your config you're allow only one host, so any others are denied.

share|improve this answer
    
Ahh... I missed the idea that the Directory path was not relative to the DocumentRoot. Let me try this tomorrow. –  mbrownnyc May 17 '12 at 3:03
    
This didn't solve the problem. But it's clear what you've said. –  mbrownnyc May 17 '12 at 13:28
    
Maybe you dont have index.html file in your /var/www/website directory. –  kbec May 17 '12 at 14:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.