I have a default installation of Apache2 (2.4) on Ubuntu Server 18.04 with MySQL and PHP. I didn't set up any virtual hosts.
I placed files into /var/www that I want to serve up, but I need to deny access to /var/www/files. Here's the relevant section from /etc/apache2/apache2.conf
# Sets the default security model of the Apache2 HTTPD server. It does # not allow access to the root filesystem outside of /usr/share and /var/www. # The former is used by web applications packaged in Debian, # the latter may be used for local directories served by the web server. If # your system is serving content from a sub-directory in /srv you must allow # access here, or in any related virtual host. <Directory "/"> Options FollowSymLinks AllowOverride None Require all denied </Directory> <Directory "/usr/share"> AllowOverride None Require all granted </Directory> <Directory "/var/www"> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Directory "/var/www/files"> Require all denied </Directory>
var/www/files is still browseable and has a nice directory listing. Why is
<Directory "/var/www/files"> being ignored?
If I change the /var/www section from
Require all granted to
Require all denied, that takes the whole site down, as expected.
Note that I don't want to use .htaccess, as I believe that's being deprecated.