Yes, another question about Apache httpd and "Require ip". I want to limit access with "Require IP", because I need to run some vhost configurations with httpd.
I tried various versions of configurations and none of them worked. This is my 20th try, so please ignore some "not so good" options and focus on the section with "Require IP".
OS: EL 7
httpd: 2.4.6
SELinux: permissive for testing purposes
Loaded modules according to "httpd -M":
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
access_compat_module (shared)
actions_module (shared)
alias_module (shared)
allowmethods_module (shared)
auth_basic_module (shared)
auth_digest_module (shared)
authn_anon_module (shared)
authn_core_module (shared)
authn_dbd_module (shared)
authn_dbm_module (shared)
authn_file_module (shared)
authn_socache_module (shared)
authz_core_module (shared)
authz_dbd_module (shared)
authz_dbm_module (shared)
authz_groupfile_module (shared)
authz_host_module (shared)
authz_owner_module (shared)
authz_user_module (shared)
autoindex_module (shared)
cache_module (shared)
cache_disk_module (shared)
data_module (shared)
dbd_module (shared)
deflate_module (shared)
dir_module (shared)
dumpio_module (shared)
echo_module (shared)
env_module (shared)
expires_module (shared)
ext_filter_module (shared)
filter_module (shared)
headers_module (shared)
include_module (shared)
info_module (shared)
log_config_module (shared)
logio_module (shared)
mime_magic_module (shared)
mime_module (shared)
negotiation_module (shared)
remoteip_module (shared)
reqtimeout_module (shared)
rewrite_module (shared)
setenvif_module (shared)
slotmem_plain_module (shared)
slotmem_shm_module (shared)
socache_dbm_module (shared)
socache_memcache_module (shared)
socache_shmcb_module (shared)
status_module (shared)
substitute_module (shared)
suexec_module (shared)
unique_id_module (shared)
unixd_module (shared)
userdir_module (shared)
version_module (shared)
vhost_alias_module (shared)
dav_module (shared)
dav_fs_module (shared)
dav_lock_module (shared)
lua_module (shared)
mpm_prefork_module (shared)
proxy_module (shared)
lbmethod_bybusyness_module (shared)
lbmethod_byrequests_module (shared)
lbmethod_bytraffic_module (shared)
lbmethod_heartbeat_module (shared)
proxy_ajp_module (shared)
proxy_balancer_module (shared)
proxy_connect_module (shared)
proxy_express_module (shared)
proxy_fcgi_module (shared)
proxy_fdpass_module (shared)
proxy_ftp_module (shared)
proxy_http_module (shared)
proxy_scgi_module (shared)
proxy_wstunnel_module (shared)
systemd_module (shared)
cgi_module (shared)
Content of /etc/httpd/conf/httpd.conf:
ServerRoot "/etc/httpd"
Listen 80
Include conf.modules.d/*.conf
User apache
Group apache
ServerAdmin root@localhost
ServerName myhost.example.com:80
DocumentRoot "/var/www/html"
<Directory />
AllowOverride none
Require all denied
</Directory>
<Directory "/var/www">
AllowOverride None
Require all granted
</Directory>
<Directory "/var/www/html">
<IfModule mod_authz_core.so>
<RequireAny>
Require ip 1.2.3.4/32
</RequireAny>
</IfModule>
Options Indexes FollowSymLinks
AllowOverride All
</Directory>
<IfModule dir_module>
DirectoryIndex index.html
</IfModule>
<Files ".ht*">
Require all denied
</Files>
ErrorLog "logs/error_log"
LogLevel warn
<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
<IfModule logio_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
</IfModule>
CustomLog "logs/access_log" combined
</IfModule>
<IfModule alias_module>
ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>
<Directory "/var/www/cgi-bin">
AllowOverride None
Options None
Require all granted
</Directory>
<IfModule mime_module>
TypesConfig /etc/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
</IfModule>
AddDefaultCharset UTF-8
<IfModule mime_magic_module>
MIMEMagicFile conf/magic
</IfModule>
EnableSendfile on
IncludeOptional conf.d/*.conf
Content of /etc/httpd/conf.d/vhost1.conf:
<VirtualHost someFQDN.example.com:80>
VirtualDocumentRoot "/var/www/html"
ServerName someFQDN.example.com
ErrorLog "logs/error_log"
CustomLog "logs/access_log" combined
HostnameLookups Off
UseCanonicalName Off
</VirtualHost>
<Directory /var/www/html>
<IfModule mod_authz_core.so>
<RequireAny>
Require ip 1.2.3.4/32
</RequireAny>
</IfModule>
Options +Indexes
AllowOverride none
</Directory>
Path of and name of mod_authz_core:
/usr/lib64/httpd/modules/mod_authz_core.so
If I try to access vhost1, I get the page instead of a deny.
If I try to block my IP explicitly, I get the page instead of a deny.
I tried to use it with/without "IfModule", with/without "RequireAny", used "mod_authz_core.c"
and "authz_core_module" for "IfModule" and various versions with various mixtures of all
these options.
Hints from the documentation and other posts didn't help either.
Currently I am a bit lost and don't know from which corner I should start
to break down this problem.
Does anyone see a problem with my configuration?
