Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are running Apache 2.2.22 on a Solaris 10 environment.

We have a specific URL that we want to limit access to by IP. We recently implemented a CDN and now have the added complexity that the IP's that a request are shown to be coming from are actually the CDN servers and not the ultimate end user. In the case that we need to back the CDN out, we want to handle the case where either the CDN is forwarding the request, or the ultimate client is sending the request directly.

The CDN sends the end user IP address in an HTTP header (for this scenario that header is called "User-IP"). Here is the configuration that we have put in place:

SetEnvIf User-IP (\d+\.\d+\.\d+\.\d+) REAL_USER_IP=$1
SetEnvIf REAL_USER_IP "(10\.1\.2\.3|192\.168\..+)" access_allowed=1

<Location /uri/>
    Order deny,allow
    Allow from 10.1.2.3 192.168.
    allow from env=access_allowed
    Deny from all
</Location>

This seems to work fine for a time, however at some point the web server starts serving 403 errors to the end user - so for some reason it is restricting access. The odd thing is that a bounce of the web server seems to resolve the issue, but only for a time - then the behavior comes back.

It might be worthwhile to note as well that this URL is delegated to a JBoss server via mod_jk. The denial of access is, however; confirmed to be at the Apache layer and the issue only seems to happen after the server has been running for some time.

share|improve this question
    
Some other interesting things of note. While all servers exhibit this behavior (or have), one server can be exhibiting it while all others receiving and process requests normally. This leads me to believe that it is not a configuration issue, but something else is going on in the environment. –  rbieber Sep 27 '12 at 15:11
    
This may be a red herring, but I noticed that the only "allow from" in my configuration that is all lowercase is the one that uses the 'env=' syntax, which is where I am seeing this problem. All research I've done says that Apache directives are case insensitive - but I ran across a presentation today that talks about "Require" being case sensitive. This would not explain the intermittent nature of the errors, but would be good to rule out. –  rbieber Oct 2 '12 at 16:10
    
It is a red herring. Allow is case insensitive. –  rbieber Oct 2 '12 at 18:13
    
More information. We have two Apache 2.2.x modules that are binary installs. mod-jk is one. The other is versioned as a apache-2.2.4 module. We are compiling for Solaris 10 with gcc. Not sure if different compilers can cause these intermittent types of errors. –  rbieber Oct 2 '12 at 18:40
    
This issue has disappeared as mysteriously as it appeared - with no configuration changes to support a change in behavior. –  rbieber Oct 11 '12 at 13:04
show 1 more comment

1 Answer

up vote 0 down vote accepted

Here is the final configuration that solved our problem:

SetEnvIf User-IP (\d+\.\d+\.\d+\.\d+) REAL_USER_IP=$1

SetEnvIf Remote_Addr "(10\.1\.2\.3|192\.168\..+)" access_allowed=1
SetEnvIf REAL_USER_IP "(10\.1\.2\.3|192\.168\..+)" access_allowed=1

<Location /uri/>
    Order deny,allow
    Allow from env=access_allowed
    Deny from all
</Location>

It looks like the explicit allow of the source IP's was the issue, since the REAL_USER_IP could be valid but the explicit allow with IP's in it failed.

We basically now chain the SetEnvIf statements to ensure that the environment variable "access_allowed" is set if either Remote_Addr or REAL_USER_IP match our IP's - and allow only on the environment variable.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.