0

I'm using this simple .htaccess file in a media uploads folder to allow the customer to see what's been uploaded.

Options +Indexes
IndexOptions +FancyIndexing

Is it possible to add a directive to restrict access to only a few IP's? Generally we're not overly worried about the security of these, which is why we're not protecting them with a user/pass setup. However, a tiny bit of security wouldn't hurt :)

Bonus Question... (really giving away my lack of apache config stuff here): Is it possible to have an if..else type setup so that IF the visitor doesn't have a recognised IP, they are re-directed to a specific page.

Cheers! Ben

Improve this question

2 Answers 2

Reset to default
5

If you want to restrict by IP , simply add

<Directory /path/to/the/folder>
            Options +Indexes
            IndexOptions +FancyIndexing
            Order deny,allow
            Deny from all
            Allow from X.X.X.X
</Directory>

If you have pattern in IP address, you could concise the rule also. Like if you want to allow IP begining with 192.

then 

Allow from 192

will allow all the IP beginning with 192.

Bonus question: you don't want to just prevent page loads from the external networks, but want to send them to a different page, mod_rewrite module of apache can come to rescue. Assuming your local net is 192.168.1.0/24:

RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^192\.168\.1
RewriteCond !^/page_to_redirect
RewriteRule .* /page_to_redirect [R,L]

Play around with it.

Improve this answer
3
  • Excellent! That's so useful... just a final gap needing filling, What was this for: RewriteCond !^/page_to_redirect Was this only for use if the redirect page was in the same DIR?
    – Mere Development
    Feb 9, 2012 at 15:36
  • yes to prevent loop if the user starts from the very page you wanted to redirect to
    – kaji
    Feb 9, 2012 at 15:40
  • I think RewriteCond !^/page_to_redirect must be replaced with RewriteCond %{REQUEST_URI} !^/page_to_redirect otherway the redirection will not work
    – Jerzy Gebler
    Oct 9, 2019 at 8:14
2

As this is the first listing on Goggle index for "apache directory only allow ip" and also for those wanting to restrict access by IP. If you're using Apache version 2.3 or later you should be using the Require directive.

Taken from Apache Documentation: 

Require all granted
    Access is allowed unconditionally.
Require all denied
    Access is denied unconditionally.
Require env env-var [env-var] ...
    Access is allowed only if one of the given environment variables is set.
Require method http-method [http-method] ...
    Access is allowed only for the given HTTP methods.
Require expr expression
    Access is allowed if expression evaluates to true.

Some of the allowed syntaxes provided by mod_authz_user, mod_authz_host, and mod_authz_groupfile are:

Require user userid [userid] ...
    Only the named users can access the resource.
Require group group-name [group-name] ...
    Only users in the named groups can access the resource.
Require valid-user
    All valid users can access the resource.
Require ip 10 172.20 192.168.2
    Clients in the specified IP address ranges can access the resource.

Require Directive Docs Link: https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require

Also See Here: https://httpd.apache.org/docs/2.4/howto/access.html

Also for Indexing Options See: https://httpd.apache.org/docs/2.4/mod/mod_autoindex.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .