1

I have an Apache (2.2) serving a web-app on example.com. That web-app has a debug-page reachable via example.com/debug. /debug is currently protected with a HTTP basic auth. As there is only a very small user-base who has access to the debug-page, I would like to hide it based on IP address and return 404 to clients not accessing from our VPN.

Serving a 404 based on IP-address only is easy and is described in https://serverfault.com/a/13071. But as soon I add authentication, the users see a 401 instead of a 404.

Basically, what I need is:

if ($REMOTE_ADDR ~ 10.11.12.*):
  do_basic_auth (aka return 401)
else:
  return 404

UPDATE This works:

<VirtualHost ...>
...
SetEnvIf REMOTE_ADDR 10.128.0.* HAS_debug=1
SetEnvIf REMOTE_ADDR 10.128.1.* HAS_debug=1
SetEnvIf REMOTE_ADDR 10.128.2.* HAS_debug=1

RewriteEngine On
RewriteCond %{ENV:HAS_debug} !=1
RewriteRule ^/debug($|/) - [R=404,L]

<Location /debug>
    AuthType Basic
    AuthName "hidden-debug"
    AuthUserFile ...
    Require valid-user
</Location>
</VirtualHost>

The crucial part was rewriting outside of the Location.

1 Answer 1

2

If you have/don't mind enabling mod_rewrite, you can hide the directory from unknown IPs by rewriting requests for the debug directory (in an .htaccess in the parent directory) to return a 404 if the IP is unknown, and leave a standard basic auth .htaccess in your debug directory for authenticating users who make it that far.

RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=<vpn ip>
RewriteRule ^debug($|/) - [L,R=404]

(This example lifted directly from Returning 404 code for unauthorized attempts found when I was googling for the exact syntax you'd need)

3
  • Interesting. This works inside a <VirtualHost> but not outside of it as I tried before.
    – zhenech
    Nov 6, 2013 at 16:45
  • That could be an allowoverride thing - your non-virtualhost config might not be allowing the use of mod_rewrite from .htaccess?
    – Phil
    Nov 6, 2013 at 16:50
  • The config was in /etc/apache2/conf.d, so no .htaccess restrictions in use, and no errors about these.
    – zhenech
    Nov 7, 2013 at 7:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .