0

I'm recently upgraded from 2.2 to 2.4 and I'm having trouble with access denied on a vhost. The error log is

[access_compat:error] [pid 27948] [client 1.2.3.4:5] AH01797: client denied by server configuration: /var/www/mysite

Now in my apache2.conf I currently have

<Directory />
  Options FollowSymLinks
  AllowOverride None
  Require all denied
</Directory>

<Directory /var/www/>
  Options Indexes FollowSymLinks
  AllowOverride None
  Require all granted
</Directory>

And in my vhost file I have

<Directory /var/www/mysite>
  Require all granted
</Directory>

But accessing my site gives the access denied error.

in my vhost config's <Directory> section.

I need the auth compat module for now because of lots of .htaccess files relying on it, but I don't see why it's needed at the server config level when I'm properly using the newer Require all syntax?

What works

If I put the following in my vhost's Directory section, it works.

Order deny,allow

Take it away (leaving the Required all granted) and it fails again. Its like the compat module is defaulting to Order allow,deny but there is no such statement as far as I can see (not in apache.conf, not in conf-enabled/*, not in sites-enabled/*default*).

The Apache docs do not state how the compat and newer authz modules work together (there's a comment on their site point this out). I have implemented the change on 6 other servers without a problem. I've dealt with the ensuring .conf is at the end of the configuration files. I've run apache2ctl configtest, I've run apache2ctl -S to look at the vhosts config; all good.

Why is the old compat Order statement required? / Why is the compat stuff apparently overriding the newer config?

Improve this question
1

2 Answers 2

Reset to default
1

It's not Apache's fault (as if it ever were going to be!). I found that one of my vhosts included an Order allow,deny statement in the root directory, and that this snippet had somehow been put outside the closing </VirtualHost> element.

Because Apache sources all enabled vhosts into a single file, this was the equivalent of putting it at the top, global level. Only by switching on and off vhosts one by one did I find the problem.

Hopefully this question highlights a useful gotcha for someone else.

Improve this answer
0

You did not write the name of the vhost file. In apache 2.4 it must have the suffix .conf

Otherwise run through the check-list here.

Updating Virtual Host Settings from Apache 2.2 to Apache 2.4

Improve this answer
3
  • Thanks for your suggestion but yeah, that's fine, all my conf files end .conf.
    – artfulrobot
    Nov 10, 2015 at 10:42
  • OK, fine. There is one more thing I dont understand: How come it works with "Order deny,allow" and apache 2.4? It should not be possible. There could be a symlink which points to another directory in /etc/ .
    – hschou
    Nov 10, 2015 at 12:57
  • The old Order stanzas are supported via the auth compat module. This is important for support in old .htaccess files
    – artfulrobot
    Nov 10, 2015 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .