1

Yes, another question about Apache httpd and "Require ip". I want to limit access with "Require IP", because I need to run some vhost configurations with httpd.

I tried various versions of configurations and none of them worked. This is my 20th try, so please ignore some "not so good" options and focus on the section with "Require IP".

OS: EL 7
httpd: 2.4.6
SELinux: permissive for testing purposes

Loaded modules according to "httpd -M":

Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 access_compat_module (shared)
 actions_module (shared)
 alias_module (shared)
 allowmethods_module (shared)
 auth_basic_module (shared)
 auth_digest_module (shared)
 authn_anon_module (shared)
 authn_core_module (shared)
 authn_dbd_module (shared)
 authn_dbm_module (shared)
 authn_file_module (shared)
 authn_socache_module (shared)
 authz_core_module (shared)
 authz_dbd_module (shared)
 authz_dbm_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_owner_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cache_module (shared)
 cache_disk_module (shared)
 data_module (shared)
 dbd_module (shared)
 deflate_module (shared)
 dir_module (shared)
 dumpio_module (shared)
 echo_module (shared)
 env_module (shared)
 expires_module (shared)
 ext_filter_module (shared)
 filter_module (shared)
 headers_module (shared)
 include_module (shared)
 info_module (shared)
 log_config_module (shared)
 logio_module (shared)
 mime_magic_module (shared)
 mime_module (shared)
 negotiation_module (shared)
 remoteip_module (shared)
 reqtimeout_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 slotmem_plain_module (shared)
 slotmem_shm_module (shared)
 socache_dbm_module (shared)
 socache_memcache_module (shared)
 socache_shmcb_module (shared)
 status_module (shared)
 substitute_module (shared)
 suexec_module (shared)
 unique_id_module (shared)
 unixd_module (shared)
 userdir_module (shared)
 version_module (shared)
 vhost_alias_module (shared)
 dav_module (shared)
 dav_fs_module (shared)
 dav_lock_module (shared)
 lua_module (shared)
 mpm_prefork_module (shared)
 proxy_module (shared)
 lbmethod_bybusyness_module (shared)
 lbmethod_byrequests_module (shared)
 lbmethod_bytraffic_module (shared)
 lbmethod_heartbeat_module (shared)
 proxy_ajp_module (shared)
 proxy_balancer_module (shared)
 proxy_connect_module (shared)
 proxy_express_module (shared)
 proxy_fcgi_module (shared)
 proxy_fdpass_module (shared)
 proxy_ftp_module (shared)
 proxy_http_module (shared)
 proxy_scgi_module (shared)
 proxy_wstunnel_module (shared)
 systemd_module (shared)
 cgi_module (shared)

Content of /etc/httpd/conf/httpd.conf:

ServerRoot "/etc/httpd"
Listen 80
Include conf.modules.d/*.conf
User apache
Group apache
ServerAdmin root@localhost
ServerName myhost.example.com:80
DocumentRoot "/var/www/html"

<Directory />
    AllowOverride none
    Require all denied
</Directory>
<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>
<Directory "/var/www/html">
    <IfModule mod_authz_core.so>
    <RequireAny>
        Require ip 1.2.3.4/32
    </RequireAny>
    </IfModule>
    Options Indexes FollowSymLinks
    AllowOverride All
</Directory>
    
<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>
<Files ".ht*">
    Require all denied
</Files>

ErrorLog "logs/error_log"
LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "logs/access_log" combined
</IfModule>

<IfModule alias_module>
   ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule mime_module>
    TypesConfig /etc/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>

AddDefaultCharset UTF-8

<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>  

EnableSendfile on
IncludeOptional conf.d/*.conf

Content of /etc/httpd/conf.d/vhost1.conf:

<VirtualHost someFQDN.example.com:80>
        VirtualDocumentRoot "/var/www/html"
        ServerName someFQDN.example.com
        ErrorLog "logs/error_log"
        CustomLog "logs/access_log" combined
        HostnameLookups Off
        UseCanonicalName Off
</VirtualHost>

<Directory /var/www/html>
        <IfModule mod_authz_core.so>
         <RequireAny>
                Require ip 1.2.3.4/32
         </RequireAny>
        </IfModule>
        Options +Indexes
        AllowOverride none
</Directory>

Path of and name of mod_authz_core:

/usr/lib64/httpd/modules/mod_authz_core.so

If I try to access vhost1, I get the page instead of a deny.
If I try to block my IP explicitly, I get the page instead of a deny.
I tried to use it with/without "IfModule", with/without "RequireAny", used "mod_authz_core.c"
and "authz_core_module" for "IfModule" and various versions with various mixtures of all
these options.

Hints from the documentation and other posts didn't help either.
Currently I am a bit lost and don't know from which corner I should start
to break down this problem.

Does anyone see a problem with my configuration?

1 Answer 1

0

After a night of sleep I went back to square one and
checked the documentation from httpd.

Reading it again I saw, that they use for httpd 2.4 the module name "authz_host_module".
Edited my configuration and it suddenly works.

Example:

<VirtualHost someFQDN.example.com:80>
        VirtualDocumentRoot "/var/www/html"
        ServerName someFQDN.example.com
        ErrorLog "logs/error_log"
        CustomLog "logs/access_log" combined
        HostnameLookups Off
        UseCanonicalName Off </VirtualHost>

<Directory /var/www/html>
        <IfModule authz_host_module>
         <RequireAny>
                Require ip 1.2.3.4/32
         </RequireAny>
        </IfModule>
        Options +Indexes
        AllowOverride none
</Directory>

I hope this will someone in the future help.

1
  • 1
    I'm glad you solved it. I think this shows that it would be better to leave out the <IfModule authz_host_module>. If that module isn't loaded, it would be better for the server to refuse to start than for your Require ip directive to be ignored. May 21, 2021 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.