0

I am running Apache 2.4 and according to the documentation I found on the apache website (http://httpd.apache.org/docs/current/sections.html), under the section "How the sections are merged" it says that the virtual host configurations should override the server configurations.

I have a filesmatch server config regex to prevent public access to important wordpress files using "order deny, allow" logic:

<FilesMatch "wp-login\.php|xmlrpc\.php|admin-ajax\.php">
   Include conf/global_acl.conf
</FilesMatch>

Then under my virtual host I have another filesmatch to allow specific access to certain files to enable a wordpress plugin:

<FilesMatch "^(xmlrpc|wp-trackback)\.php$">
   Order Deny,Allow
   Allow from wordpress.com
   Allow from 123.123.123.123
</FilesMatch>

My goal is to have the server config allow process, be inherited by the virtual host, then have the additional allow directives parsed by the virtual host. It does not seem to be working. If I modify the server level by removing the xmlrpc file, the virtual host will work.

EDIT

To clear up confusion, my issue is that under the virtual host, I am being denied even though I am using IP 123.123.123.123. I am expecting the whitelist entries from the server config to be inherited by the virtual host. Then having additional whitelisted allows in the virtualhost config. I have a DENY FROM ALL at the top of my server config.

Any ideas what is going on? Thanks in advance!

2
  • 1
    Do you have the appropriate AllowOverride directive set? – noitsbecky Jun 18 '15 at 15:24
  • Isn't that just for htaccess files to override the configs? the above configs are being done in the main config file. – DontStealMyFish Jun 18 '15 at 15:34
0

A change made in 2.4 was the replacement of the syntax Allow from by the new Require all granted and similar. See apache upgrading doc section Access control.

There is a compat module you can use to avoid changes. If you use it, and choose Order Deny,Allow then if you have no Deny statements, all accesses will be allowed (see apache compat: Order).

So either use Order Allow,Deny or add a Deny from all.

3
  • I have the mod_access_compat module loaded though. – DontStealMyFish Jun 18 '15 at 19:48
  • ok. you probably need a Deny from all in your 2nd FilesMatch. – meuh Jun 19 '15 at 5:01
  • Sorry, I may have been unclear. See my edit. The issue in particular is that I am not being allowed from 123.123.123.123 – DontStealMyFish Jun 19 '15 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.