1 |
On Sunday, 29 November 2020 18:22:09 GMT thelma@×××××××××××.com wrote: |
2 |
> Thelma |
3 |
> |
4 |
> On 11/29/2020 03:22 AM, Michael wrote: |
5 |
> > On Sunday, 29 November 2020 07:30:16 GMT thelma@×××××××××××.com wrote: |
6 |
> >> I'm trying to deny access to all except specific IP address in a |
7 |
> >> directory, just testing it. |
8 |
> >> |
9 |
> >> In modules.d/00_default_settings.conf |
10 |
> >> |
11 |
> >> <Directory "/var/www/localhost/htdocs"> |
12 |
> >> |
13 |
> >> Options MultiViews |
14 |
> >> AllowOverride All |
15 |
> >> Require all granted |
16 |
> >> |
17 |
> >> </Directory> |
18 |
> >> |
19 |
> >> in admin/.htaccess |
20 |
> >> |
21 |
> >> <RequireAll> |
22 |
> >> |
23 |
> >> Require all denied |
24 |
> >> Require ip 10.0.0.100 |
25 |
> >> |
26 |
> >> </RequireAll> |
27 |
> >> |
28 |
> >> My IP is 10.0.0.112 and I can still access the server /admin directory |
29 |
> >> |
30 |
> >> What am I missing? |
31 |
> > |
32 |
> > In apache 2.4 the access control syntax has changed. The RequireAll |
33 |
> > directive means *all* authorisation directives within it must succeed. |
34 |
> > |
35 |
> > https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#requireall |
36 |
> > |
37 |
> > What happens if you just remove the first line, "Require all denied"? |
38 |
> |
39 |
> As you suggested I have: |
40 |
> in admin/.htaccess |
41 |
> |
42 |
> <RequireAll> |
43 |
> Require ip 10.0.0.100 |
44 |
> </RequireAll> |
45 |
> |
46 |
> My IP is: 10.0.0.112 and it still allow me to access it. I know apache |
47 |
> 2.4 is reading the file as the the below direcive works. |
48 |
|
49 |
I've tested different RequireAll directives in a .htaccess file and with |
50 |
otherwise default apache settings I can confirm: |
51 |
|
52 |
This is correct: |
53 |
========================= |
54 |
<RequireAll> |
55 |
Require ip 10.0.0.100 |
56 |
</RequireAll> |
57 |
========================= |
58 |
will only allow visitors from 10.0.0.100 to access the directory content. |
59 |
|
60 |
This is also correct: |
61 |
========================= |
62 |
<RequireAll> |
63 |
Require all granted |
64 |
Require ip 10.0.0.100 |
65 |
</RequireAll> |
66 |
========================= |
67 |
will only allow visitors from 10.0.0.100 to access the directory content. |
68 |
|
69 |
Finally, this won't work: |
70 |
========================= |
71 |
<RequireAll> |
72 |
Require all denied |
73 |
Require ip 10.0.0.100 |
74 |
</RequireAll> |
75 |
========================= |
76 |
because it returns 403 for all clients irrespective of IP address, since both |
77 |
subdirectives must be correct for the RequireAll to be true. |
78 |
|
79 |
I notice you have 'Options MultiViews' in your modules.d/ |
80 |
00_default_settings.conf, which will parse paths to find and serve any file |
81 |
requested by the client even if the URL is not complete. It might be this |
82 |
conflicts with your .htaccess within admin/ subdirectory, but I'm not sure. |
83 |
Something in apache logs may shed light in this. |
84 |
|
85 |
|
86 |
> AuthName "restricted stuff" |
87 |
> AuthType Basic |
88 |
> AuthUserFile "/etc/apache2/users" |
89 |
> require user webmaster |
90 |
> |
91 |
> I've tried adding |
92 |
> RewriteEngine on |
93 |
> |
94 |
> With it, I can not login at all (access denied) regardless of IP. |
95 |
|
96 |
With apache 2.4 a new <If> directive was added to perform conditional checks |
97 |
and replace/augment many of the mod_rewrite functionalities. I don't know how |
98 |
you have structured your RewriteCond and RewriteRule, but obviously they don't |
99 |
work as intended if they totally block access. |
100 |
|
101 |
You could check conflicting rules between your apache config and any .htaccess |
102 |
directives, or any loose and contradictory .htaccess files in higher |
103 |
subdirectories. |