4

I've a website (running on CentOS at Google Cloud, Apache 2.4.37), say it's name is awesomesite.co.id.

There are certain pages on that website, e.g awesomesite.co.id/dev123/secret.html which is not supposed to be accessible from any network, except from whitelisted IPs. So here's what I already did:

  1. Edited /etc/httpd/conf.d/awesome-site.conf. I put 2 whitelisted IPs on it.
    <VirtualHost *:80>
    ServerName awesomesite.co.id
    DocumentRoot /var/www/html/awesome
    ErrorLog /var/log/httpd/awesome-site-error.log
    CustomLog /var/log/httpd/awesome-site-requests.log combined
    #commented for testing PHP proxy, allow both http and https work
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =awesomesite.co.id
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
    </VirtualHost>
    
    <Directory /dev123/*>
            Order deny,allow
            Deny from all
            Allow from 123.123.100.100
            Allow from 200.200.44.59
    </Directory>
  1. Restarted Apache: systemctl restart http.service

I tried to access awesomesite.co.id/dev123/secret.html on a few mobile devices (all different telco providers). The result is all devices could accessed that page normally.

So what's the correct way, then?

1 Answer 1

5

The Allow, Deny, and Order directives, provided by mod_access_compat, are deprecated as of version 2.4 and will no longer work.

Use Require instead:

Require ip 123.123.100.100
Require ip 200.200.44.59

The Require directive is provided by the mod_authz_host module.

More infirmation can be found in the Apache HTTP Server documentation

Note that a CIDR range such as Require ip 200.200.44.0/24 is possible as well (see here for more examples):

In the second form, ip.address is an IP address, a partial IP address, a network/netmask pair, or a network/nnn CIDR specification. Either IPv4 or IPv6 addresses may be used.

3
  • 1
    Can we Require a specific IP range, such as Require 11.22.33.0/24? I didn't find it in the doc, but another post seemed to say it works, without real confirmation. Any idea @digijay?
    – Basj
    Commented Dec 1, 2021 at 0:48
  • Yes, a CIDR address should work, see the apache2 doc here
    – digijay
    Commented Dec 1, 2021 at 6:59
  • 1
    Thanks @digijay, I added this information in your answer for future reference.
    – Basj
    Commented Dec 1, 2021 at 8:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .