I turned on apache's server status module and intended it to be readable only from my own ip or when browsing via the lynx text browser sshed in to the the server itself. Unfortunately it turns out that I was able to read the details at the /server-status url from other ips, and apparently any public ip in general.
Yet when I look at the allow/deny stack, it seems right to me. I tried to deny from all first, and only allow from a few specific locations second. What did I do wrong? Here is my httpd.conf
# Uncomment the following lines to enable mod_status support: # ExtendedStatus On # ServerTokens Prod # Already set in the conf.d/security #Don't reveal server apache or debian details. <Location /server-status> SetHandler server-status Order Deny,Allow Deny from all Allow from localhost, bitlucid.com, 184.108.40.206, 220.127.116.11, 18.104.22.168 </Location>