Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an Apache (2.2) serving a web-app on example.com. That web-app has a debug-page reachable via example.com/debug. /debug is currently protected with a HTTP basic auth. As there is only a very small user-base who has access to the debug-page, I would like to hide it based on IP address and return 404 to clients not accessing from our VPN.

Serving a 404 based on IP-address only is easy and is described in http://serverfault.com/a/13071. But as soon I add authentication, the users see a 401 instead of a 404.

Basically, what I need is:

if ($REMOTE_ADDR ~ 10.11.12.*):
  do_basic_auth (aka return 401)
else:
  return 404

UPDATE This works:

<VirtualHost ...>
...
SetEnvIf REMOTE_ADDR 10.128.0.* HAS_debug=1
SetEnvIf REMOTE_ADDR 10.128.1.* HAS_debug=1
SetEnvIf REMOTE_ADDR 10.128.2.* HAS_debug=1

RewriteEngine On
RewriteCond %{ENV:HAS_debug} !=1
RewriteRule ^/debug($|/) - [R=404,L]

<Location /debug>
    AuthType Basic
    AuthName "hidden-debug"
    AuthUserFile ...
    Require valid-user
</Location>
</VirtualHost>

The crucial part was rewriting outside of the Location.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

If you have/don't mind enabling mod_rewrite, you can hide the directory from unknown IPs by rewriting requests for the debug directory (in an .htaccess in the parent directory) to return a 404 if the IP is unknown, and leave a standard basic auth .htaccess in your debug directory for authenticating users who make it that far.

RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=<vpn ip>
RewriteRule ^debug($|/) - [L,R=404]

(This example lifted directly from Returning 404 code for unauthorized attempts found when I was googling for the exact syntax you'd need)

share|improve this answer
    
Interesting. This works inside a <VirtualHost> but not outside of it as I tried before. –  zhenech Nov 6 '13 at 16:45
    
That could be an allowoverride thing - your non-virtualhost config might not be allowing the use of mod_rewrite from .htaccess? –  Phil Nov 6 '13 at 16:50
    
The config was in /etc/apache2/conf.d, so no .htaccess restrictions in use, and no errors about these. –  zhenech Nov 7 '13 at 7:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.