0

I have Apache2 running on a Debian server. My virtualhost (one for now) are already configured in /etc/apache2/sites-available/default and are working fine:

# /etc/apache2/sites-available/default 
<VirtualHost *:80>
    ServerName domain.com
    DocumentRoot /var/www/
    <Directory />
        AllowOverride None
        Order Deny,Allow
        Deny from all
    </Directory>
    <Directory /var/www/>        
        AllowOverride None    
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

However, by looking at the file /etc/apache2/conf.d/security, I've seen we can hardened Apache2 by also preventing access to file system root (may be especially useful when no ServerName match virtualhost configuration) by commenting out:

# /etc/apache2/conf.d/security
<Directory />
    AllowOverride None
    Order Deny,Allow
    Deny from all
</Directory>

When I do that and reboot apache, all my pages returns the 403 Forbidden error. What I'm looking for is just prevent access to file system root and allow the VirtualHost "domain.com" to return pages in /var/www/. What I've misunderstood? What the way to secure Apache2 against unauthorized directories access? Thanks!

1

The way access control is done has changed with apache 2.4.

See this document about upgrading from 2.2 to 2.4. Notably:

In this example, all requests are allowed.

2.2 configuration:

Order allow,deny
Allow from all

2.4 configuration:

Require all granted
-1

The locations you are affecting are relative to the DocumentRoot of the given virtual host.

so / would affect files in /var/www if the DocumentRoot is /var/www.

Think of Directory as DocumentRoot/Directory. Apache should already forbid things outside of DocumentRoot.

  • Thanks. So in my case, "<Directory /var/www/>" is incorrect because it refers to "/var/www/var/www" ? So If I'm correct, I have to delete "<Directory /var/www/>" and need to have the "Allow from all" directive in the "<Directory />" section ? :) – claireusa Mar 5 '15 at 11:06
  • 1
    DrBobbleChops is confusing <Directory> and <Location> directives. – wurtel Mar 5 '15 at 12:13
  • @wurtel you're right. This solution doesn't work: everything get again always 403 forbidden. Could you please elaborate? Thanks! – claireusa Mar 5 '15 at 18:00
  • Agreed, I got the wrong end of the stick here! – DrBobblechops Mar 6 '15 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.