Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have on a Ubuntu Jaunty server with Apache /sites-avaliable/mysite file:

    <Directory /var/www/test.example.com/www>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All

            Order deny,allow
            Deny from all
            # internal access required dont remove
            Allow from 192
            Allow from 127
            Allow from 10
            # office
            Allow from 187.220.17.205

    </Directory>

Yet the 'www' folder is still accessible to anyone off any public IP address e.g. 212.183.140.18. I want to restrict access to only those IP addresses with the "Allow from" next to them.

Thanks in advance

Dom

share|improve this question

4 Answers 4

I believe that your problem is that your allows need to be full IPs with masks i.e.

Allow from 192.168.0.1/24 Allow from 10.1.0.0/16

etc.

share|improve this answer
    
It can be done with a partial IP address or it can be done with CIDR addressing. –  Xorlev Oct 6 '09 at 18:15

I suggest to do the job at iptables level.

It is much more secure to avoid an evil address to reach a given service, rather than make the (possibly buggy) service to actively deny the access to the client.

share|improve this answer
1  
Agreed, however. There are situations where iptables is not enough. Perhaps he wants to restrict the 'www' folder, but allow them to 'www2' or 'doc' on the same server. –  Jimmy Stenke Oct 6 '09 at 11:07
    
IO cant do iptables as we are in "accreditation mode" and we cannot access the system at the level without failing - but otherwise yes I would have done it at this level; and assuming that higher ups could actually figure out what security they wanted instead of signing off on no security and then changing their minds! –  Dominic Webb Oct 6 '09 at 11:30
    
I agree with both of course, mine was a suggestion for a "normal" case. –  AlberT Oct 6 '09 at 11:38
    
I think the "normal" case is you have a single web server running a number of sites/applications and only a few dirs that might need access control, in which case iptables is not the right tool for the job. –  Aaron Brown Oct 6 '09 at 18:10

Is mod_access enabled?

sudo apache2 -l

Also, are you using virtual hosts?

share|improve this answer
    
nope, just the default wampserver I didn't do anything fancy except the one mentioned above –  user28233 Jul 4 '10 at 9:28

check the global Apache configs, including the main one and any small included conf files.

I had this problem when a global config file had server-status access control.

Moving the server-status location into a default server config fixed that. I've had this happen in a couple different situations, I'd just suggest looking at the global config files for default access control and experiment with commenting them out or moving them around.

Also, depending on your distro, don't forget to check for a mod_access.conf file that may be setting defaults.

share|improve this answer
    
where do I find that file? –  user28233 Jul 4 '10 at 10:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.