0

From personal experience and the documentation, there may be problems when mixing old and new access control directives in the configuration, e.g.

old:

Order deny,allow
Deny from all
# ...

new:

Require all denied

Mixing old directives like Order, Allow or Deny with new ones like Require is technically possible but discouraged. mod_access_compat was created to support configurations containing only old directives to facilitate the 2.4 upgrade. Please check the examples below to get a better idea about issues that might arise.

...

In the following example, mixing old and new directives leads to unexpected results.

Upgrading to 2.4

I would like to convert to the new directives. It seems like a good idea to do this in one batch and then do a reload. However, some directives are in .htaccess files.

documentation:

0

I suggest to change the directives to something like this in your .htaccess files:

Example (you may want to check how the module is named on your system, e.g. mod_access_compat, access_compat_module):

<IfModule access_compat_module>
    Order deny,allow
    Deny from all
</IfModule>

<IfModule !access_compat_module>
    Require all denied
</IfModule>

Documentation: IfModule

The rest of the configuration can also be done this way or could be done in one batch with subsequent reload without the Ifmodules (in order not to clutter up the configuration).

Once the access_compat module is deactivated, the new directives will take effect.


Alternatively, you may want to think about moving the configuration from the .htaccess files to your webserver configuration, see:

You should avoid using .htaccess files completely if you have access to httpd main server config file.

https://httpd.apache.org/docs/2.4/howto/htaccess.html

3
  • This setup would require you to duplicate all allow rules in both blocks.If there is no Satisfy Any around, then I prefer to reset the access_compat rules with just one line inside an IfModule: Order deny,allow and then set the only allowances with Require ip etcetera. – Gerrit Mar 18 '20 at 13:30
  • mod_access_compat is only available on Apache 2.4, so the directives you posted would result in serving older "Apache 2.2" directives on an Apache 2.4 system - which I'm sure is not the intention. However, it's not necessarily as simple as reversing the logic either. I don't really think there is a method of "graceful conversion" in this regard that you would need to implement - the old directives will "work" until you decide to convert. The exception to this is if you have a system that must work on both Apache 2.2 and 2.4 without code changes. – MrWhite Mar 18 '20 at 13:47
  • @MrWhite The plan was to deactivate the access_compat module once the rules are in place. I am doing this on a site where Apache 2.4 is already running. There is no need to have this running on an older Apache system. – Sybille Peters Mar 18 '20 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.