1

Two similar .conf files on apache 2.2 are showing different effects.

The first file 000-default.conf

  • sets up a virtual host for http and
  • sets up AuthType Basic

    and shows correct behavior.

The second file 000-default-ssl.conf

  • sets up a virtual host for https,
  • includes the ssl certs and
  • sets up AuthType Basic too.

https is actually working fine but the authentication is not working on https. The given directory is simply not protected and delivered to the client. (The file is definitely working, If it gets removed form /etc/apache2/sites-enabled then https stops to work.)

000-default.conf

<VirtualHost *:80>

    ServerAdmin webmaster@domain.org
    ServerName domain.org

    DocumentRoot /var/www/
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
        DirectoryIndex index.php index.html index.htm index.shtml index.cgi
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    <Location /project/backend/>
        AuthType Basic
        AuthName "Restricted Files"
        AuthBasicProvider file
        AuthUserFile "/usr/local/apache/passwd/passwds"
        Require user project
    </Location>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

000-default-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>

    ServerAdmin webmaster@domain.org
    ServerName domain.org

    DocumentRoot /var/www/
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
        DirectoryIndex index.php index.html index.htm index.shtml index.cgi
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    <Location /project/backend/>
        AuthType Basic
        AuthName "Restricted Files"
        AuthBasicProvider file
        AuthUserFile "/usr/local/apache/passwd/passwds"
        Require user project
    </Location>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    SSLEngine on
    SSLCertificateFile  /etc/letsencrypt/live/domain.org/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/domain.org/privkey.pem

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-6]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

    SSLCertificateChainFile /etc/letsencrypt/live/domain.org/chain.pem

</VirtualHost>
</IfModule>

A diff dump to make comparison easier:

diff 000-default.conf 000-default-ssl.conf

1,2c1,3
< <VirtualHost *:80>
<
---
> <IfModule mod_ssl.c>
> <VirtualHost *:443>
>
37,39c38,50
<   # Possible values include: debug, info, notice, warn, error, crit,
<   # alert, emerg.
<   LogLevel warn
---
>   SSLEngine on
>   SSLCertificateFile  /etc/letsencrypt/live/domain.org/cert.pem
>   SSLCertificateKeyFile /etc/letsencrypt/live/domain.org/privkey.pem
>
>   <FilesMatch "\.(cgi|shtml|phtml|php)$">
>       SSLOptions +StdEnvVars
>   </FilesMatch>
>   <Directory /usr/lib/cgi-bin>
>       SSLOptions +StdEnvVars
>   </Directory>
>
>   BrowserMatch "MSIE [2-6]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
>   BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
41c52
<   CustomLog ${APACHE_LOG_DIR}/access.log combined
---
>   SSLCertificateChainFile /etc/letsencrypt/live/domain.org/chain.pem
43a55
> </IfModule>

The only actual difference is SSL related.

ports.conf should also be alright

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
  # If you add NameVirtualHost *:443 here, you will also have to change
  # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
  # to <VirtualHost *:443>
  # Server Name Indication for SSL named virtual hosts is currently not
  # supported by MSIE on Windows XP.
  NameVirtualHost *:443
  Listen 443
</IfModule>

<IfModule mod_gnutls.c>
  Listen 443
</IfModule>

Any help is highly appreciated.

1

As I see your syntax should work. I copied your Location syntax to my server and it was working perfect with TLS.

Maybe some strange entry in any configuration of enabled moduls? I tested with these moduls: actions alias auth_basic authn_file authz_default authz_groupfile authz_host authz_user autoindex cgi deflate dir env headers mime negotiation perl php5 php5_cgi reqtimeout rewrite setenvif ssl status vhost_alias

Did you restart apache? (I think so, but maybe...)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.