0

Below is a segment from the owncloud.conf file in /etc/httpd/conf.d. It is the intent to lock out all access except the 10.0 intranet and a limited set of external ip address xx.yy.0.0. However the configuration is not locking out other access. All external address are being allowed. Is there something obvious with this configuration.

<Directory /var/www/http/owncloud/>
     Options Indexes FollowSymLinks MultiViews 
     AllowOverride none
     Require all denied
     Order Deny,Allow
     Deny from all 
     Allow from 10.0.0.0/16
     Allow from xx.yy.0.0/16 
</Directory>

migrated from security.stackexchange.com Nov 22 '14 at 14:23

This question came from our site for information security professionals.

  • Not helpful, but try commenting out the "Allow from" and see if 10.0 can still access. – barrycarter Nov 22 '14 at 17:29
0

Try replacing the order, e.g.

Order Allow,Deny

Because with current setting being Order Deny,Allow you have

Deny,Allow

First, all Deny directives are evaluated; if any match, the request is denied unless it also matches an Allow directive. Any requests which do not match any Allow or Deny directives are permitted

For more info check official documentation

EDIT noticed you have directive Require all denied which I believe is not necessary here to achieve your goal.

  • Below is the current config. This is a test to lock all all clients on the local network except one. That did not work. Clients can still access owncloud. Options Indexes FollowSymLinks MultiViews AllowOverride none Order Allow,Deny Deny from all # Allow from 10.0.0.0/24 Allow from 10.0.0.24 Allow from 73.25.0.0/16 – dan sawyer Nov 11 '15 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.