I turned on apache's server status module and intended it to be readable only from my own ip or when browsing via the lynx text browser sshed in to the the server itself. Unfortunately it turns out that I was able to read the details at the /server-status url from other ips, and apparently any public ip in general.

Yet when I look at the allow/deny stack, it seems right to me. I tried to deny from all first, and only allow from a few specific locations second. What did I do wrong? Here is my httpd.conf

# Uncomment the following lines to enable mod_status support:
ExtendedStatus On

# ServerTokens Prod
# Already set in the conf.d/security
#Don't reveal server apache or debian details.

<Location /server-status>
SetHandler server-status

Order Deny,Allow
Deny from all
Allow from localhost, bitlucid.com,,,

Get rid of the commas in the "Allow from" line, those are not allowed and may cause this.

  • Hmmm, seemed promising that allow locations might be space delimited instead of comma+space delimited, but in actuality it didn't make a difference. – Kzqai Sep 19 '14 at 18:32
  • Looking at this more closely after some time, I would have tried giving each Allow from it's own line, which may have been what this answer actually was suggesting. (I no longer use apache, so did not test the theory). – Kzqai Nov 7 '16 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.