0

I have a default installation of Apache2 (2.4) on Ubuntu Server 18.04 with MySQL and PHP. I didn't set up any virtual hosts.

I placed files into /var/www that I want to serve up, but I need to deny access to /var/www/files. Here's the relevant section from /etc/apache2/apache2.conf

# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
<Directory "/">
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory "/usr/share">
        AllowOverride None
        Require all granted
</Directory>

<Directory "/var/www">
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

<Directory "/var/www/files">
        Require all denied
</Directory>

var/www/files is still browseable and has a nice directory listing. Why is <Directory "/var/www/files"> being ignored?

If I change the /var/www section from Require all granted to Require all denied, that takes the whole site down, as expected.

Note that I don't want to use .htaccess, as I believe that's being deprecated.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.