I am using Debian Lenny and Apache 2. I changed the default .htaccess file with:

AllowOverride AuthConfig

But I always get the error message not allowed here when putting any instructions in the .htaccess file.


file default:

<VirtualHost *:80>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/

        <Directory />
                Options FollowSymLinks
                Order allow,deny
                Allow from all
                AllowOverride All

        <Directory /var/www/>
                Options Indexes FollowSymLinks Includes
                #AllowOverride All
                #AllowOverride Indexes AuthConfig Limit FileInfo
                AllowOverride AuthConfig
                Order allow,deny
                Allow from all

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined

        Alias /doc/ "/usr/share/doc/"
        <Directory "/usr/share/doc/">
                Options Indexes MultiViews FollowSymLinks 
                AllowOverride None
                Order deny,allow
                Deny from all
                Allow from ::1/128



#Options +FollowSymlinks

# Prevent Directoy listing
Options -Indexes

# Prevent Direct Access to files
<FilesMatch "\.(tpl|ini)">
 Order deny,allow
 Deny from all

# SEO URL Settings
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)\?*$ index.php?_route_=$1 [L,QSA]

PHP info:


Apache Version = Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny10 with Suhosin-Patch 
Apache API Version = 20051115 
Server Administrator = webmaster@localhost 
Hostname:Port = hw-linux.homework:80 
User/Group = www-data(33)/33 
Max Requests = Per Child: 0 - Keep Alive: on - Max Per Connection: 100 
Timeouts = Connection: 300 - Keep-Alive: 15 
Virtual Server = Yes 
Server Root  = /etc/apache2 
Loaded Modules =

core mod_log_config mod_logio prefork http_core mod_so mod_alias mod_auth_basic
mod_authn_file mod_authz_default mod_authz_groupfile mod_authz_host mod_authz_user
mod_autoindex mod_cgi mod_deflate mod_dir mod_env mod_mime mod_negotiation 
mod_php5 mod_rewrite mod_setenvif mod_status 
  • 1
    Please fix your typo so others don't think that's the reason for your problem. What kind of instructions are you trying to put into the file?
    – Pekka
    May 28 '11 at 21:14
  • are the same instructions that come OPENCAR. and then allow only simple rewriting rules and the same happens May 28 '11 at 23:18
  • I update the information to my question May 29 '11 at 0:27
  • Which line does the "not allowed here" error refer to exactly?
    – Pekka
    May 29 '11 at 5:55
  • Pekka is talking about AllowOverriTe as the typo, please check it.
    – vbence
    May 29 '11 at 7:02

You will require a minimum of AllowOverride Authconfig FileInfo Options inside your <Directory> block to get the .htaccess you've posted here to work - mod_rewrite will require FileInfo Options and your <FilesMatch> block requires the Authconfig.

Also: your statement "does not work with AllowOverride All" is mistaken. You cannot specify a MORE permissive environment than AllowOverride All. When in doubt, start with that to make sure the rest of your configuration works, then narrow it down more specifically (for security's sake).


This option can be used only inside a Directory element. So you have to specify a directory which should be protected.

  • yes, I put in the application directory and "/var/www" and same thing happens. May 28 '11 at 23:11

not allowed here is usually caused by trying to set directives in .htaccess file that can only be defined in httpd.conf.

First try

AllowOverride All

In your ower most <Directory> tag to your www folder. Now your .htaccess can work in its full capacity. If this solves the problem, then you can start focusing on security and decrease the number of allowed directives one-by-one.

  • are only rules of rewriting and rewriting module is well loaded, May 28 '11 at 23:08
  • I recommend you to try AllowOverride All first (and make sure no other <Directory> tag is overriding it). See the answer for details.
    – vbence
    May 29 '11 at 7:01
  • does not work with AllowOverride All, do not know why but it only works with AuthConfig May 29 '11 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.