Apache2 Secure Status

Question

can you give me a hint why i can still access the status page from outside the allowed hosts?

<Location /server-status>
 SetHandler server-status
 Order Deny,Allow
 Deny from all
 Allow from localhost ip6-localhost
 Allow from 192.168.122.0/24
</Location>

A simple deny all isnt working too

<Location /server-status>
 SetHandler server-status
 Order Deny,Allow
 Deny from all
 #Allow from localhost ip6-localhost
 #Allow from 192.168.122.0/24
</Location>

More Information:

root@web:~# cat /etc/apache2/mods-enabled/auth*
LoadModule auth_basic_module /usr/lib/apache2/modules/mod_auth_basic.so
LoadModule authn_file_module /usr/lib/apache2/modules/mod_authn_file.so
LoadModule authz_default_module /usr/lib/apache2/modules/mod_authz_default.so
LoadModule authz_host_module /usr/lib/apache2/modules/mod_authz_host.so
LoadModule authz_user_module /usr/lib/apache2/modules/mod_authz_user.so

root@web:~# grep -rni server-status /etc/apache2/
/etc/apache2/mods-enabled/status.conf:4:# with the URL of http://servername/server-status
/etc/apache2/mods-enabled/status.conf:7:<Location /server-status>
/etc/apache2/mods-enabled/status.conf:9:    SetHandler server-status
/etc/apache2/mods-available/status.conf:4:# with the URL of http://servername/server-status
/etc/apache2/mods-available/status.conf:7:<Location /server-status>
/etc/apache2/mods-available/status.conf:9:    SetHandler server-status

Answer 1

Can you provide more of your configuration? More than just that block can affect the access controls.

Anyway, try this, which will be less likely to be overridden by some configuration elsewhere:

Order Allow,Deny
Allow from localhost ip6-localhost
Allow from 192.168.122.0/24