Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I worked my way into the subject of mapservers or to be more precise, tileservers. I set up my own instance of a tileserver based on this beginners guide (with the exception of using tilestream instead of tilestache):

The server is running an accessible via

The purpose of this exercise was to have a mapserver available, without any kind of usage restrictions (like "10.000 mapviews per month"), to serve maps that can be easily accessed via a 'frontend-geo-javascript-api' like leaflet, or mapbox.js and be shown on a blog post or a 'standalone' webpage which is build around such a map.

Although it is unlikely that the traffic explodes and the server gets into troubles, I still want to make sure that only my webpage (where I run my example which is using my tilestream-server) has access to the tilestream server.

Basically I want to keep the public away from accessing my tilestream server and i.e. only allow access if a valid key is transmitted (this seems to be what cloudmade does). Or maybe it would be an option to check the location where the request came from and only allow access from specific locations.

The TileStream server and the Webserver (version: Apache/2.2.22 (Ubuntu)) run on the same machine.

I am really lost here as I cant find any documentation about this. Any suggestions are very welcome.

share|improve this question

migrated from Mar 15 '13 at 13:47

This question came from our site for cartographers, geographers and GIS professionals.

up vote 3 down vote accepted


If you have a front-end web mapping application that you want to be the only "client" allowed access to the tile server, then it's possible via an Apache2 .conf file with order deny,allow directives.

You can use those directives to specify an IP address or hostname from which an allowed connection should originate from if it is to be given access to the tile server/folder.

Avoid .htaccess files if you can. They should only be considered when you don't have access to the root filesystem. In this case it sounds like you do so it's best to avoid .htaccess. This is usually the case on a hosted service, but you're hosting your own webserver on ubuntu right?

.conf files are stored in the root filesystem where the webserver user (like wwwrun) can't access them directly.

It looks like you could secure the /var/www/tiles folder to only allow access on the LAN.

Getting Started:

OK.... here's what you do!

That blog told you to edit the servers main httpd.conf file...

I wouldn't of, see if you can cut and paste that whole <directory> portion into a new file called /etc/apache2/conf.d/tiles.conf

Any .conf files in the conf.d folder automatically get loaded when the webserver is started. You should see a line for this in one of the servers default .conf files already (httpd.conf, default-server.conf or apache2.conf) that says Include /etc/apache2/conf.d/*.conf.

The contents of tiles.conf in it's simplest form could look like:

<Directory /var/www/tiles>
  Order deny,allow
  deny from all
  allow from localhost

You can replace localhost with an IP like or (replace this IP with whatever IP you access the webserver from if outside the LAN).

You can also specify multiple hostnames/IPs separated by a space (ie, allow from localhost 123.123.123

Replace the path to the tiles folder if needed(where the .mbtiles are saved).

Restart/Reload apache2 after you make the required changes.


A good place to see where the calls to the tiles folder are being made from is to check the /var/log/apache2/access_log entries. If you can't connect (denied access) see what IP is being denied in the error_log instead =)

You can view these logs in real-time with tail -f /var/log/apache2/access_log. The IP will be in there when trying to grab tiles from the tiles folder.

See Apache 2.2 Access Control where it explains the above approach. This method is used to restrict access to a resource on the webserver. This is not the same as Authentication which uses a username/password.

Lastly, with the <Files> Directive it's possible to restrict access to specific files instead of directories.

share|improve this answer
+1 For the detailed explanation. – thelastray Mar 15 '13 at 4:46
This works if his webpage fetches the tiles itself, and then the tiles are delivered from the Webpage. With OpenLayers it is most common to let the users browser fetch the tiles, which would render this "Allow from ..."-Apache-approach not feasible. – til_b Mar 15 '13 at 10:06
Thanks, this sounds as it could be the solution. I will try it later today and come back with the results. Although I start to doubt that this works, til_b has a point - the request will be sent within javascript. I only tried leaflet so far, but this should be library independet I guess. – mwallisch Mar 16 '13 at 10:54
@walfish3d There is also the tilestream --host flag. So --host would only allow access from the webserver. You can use the --host flag when starting the tilestream server for the first time. – SaultDon Mar 22 '13 at 20:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.