Server-status only localhost, not in ssl apache 2.2

mozer · 08-20-2019, 01:47 AM

Hello all,

I need to access server-status only from localhost so I created a basic rule in my httpd.conf, the server has SSL enabled

Code:

<IfModule mod_status.c>
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Location>
ExtendedStatus On
</IfModule>

LoadModule status_module modules/mod_status.so

it should only allow 127.0.0.1 connections but when i try to get the status from any ip of the server, i can access to it

Code:

[root@xxxxxxxx:/tmp]# wget 172.30.16.34:443/server-status
--2019-08-20 08:29:59--  http://172.30.16.34:443/server-status
Connecting to 172.30.16.34:443... conectado.
Petitionn HTTP sent, esperando respuesta... 200 No headers, assuming HTTP/0.9
Longitud: no especificado
Saving to: `server-status.7'

    [ <=>                                                                                          ] 480         --.-K/s   in 0s

2019-08-20 08:29:59 (73,9 MB/s) - `server-status.7' saved [480]

also tried to create a <Virtualhost*:443> using the same code, with no results

what am i doing wrong?

thanks!

bathory · 08-20-2019, 03:44 AM

Your config snippet looks good.
You can omit the <IfModule mod_status.c> and </IfModule> lines, because the mod_status module is loaded.

That said, make sure that the "Location /server-status" stuff is only defined once in apache config files and that you restart apache after editing configuration.
Regards

mozer · 08-20-2019, 04:07 AM

Thanks, but the directive should not let me get server status from an ip, only from 127.0.0.1 (localhost) why i can do it with wget xx.xx.xx.xx/server-status?

Cheers....

bathory · 08-20-2019, 04:47 AM

Quote:

Originally Posted by mozer

Thanks, but the directive should not let me get server status from an ip, only from 127.0.0.1 (localhost) why i can do it with wget xx.xx.xx.xx/server-status?

Cheers....

That's why I told you to restart apache after editing the config files.
Also try both http and https methods and see whta you get:

Code:

wget http://xx.xx.xx.xx/server-status
wget https://xx.xx.xx.xx/server-status

TenTenths · 08-20-2019, 04:57 AM

Quote:

Originally Posted by mozer

it should only allow 127.0.0.1 connections but when i try to get the status from any ip of the server, i can access to it

also tried to create a <Virtualhost*:443> using the same code, with no results

what am i doing wrong?

When you showed the wget request were you doing that on the server?

It's not clear from what you say from any ip of the server, if the server has multiple IP addresses then you're confusing the Listen directives with the Deny/Allow directives. Deny/Allow have NOTHING to do with what IP the status page appears ON, they control which IP has access to it. If you've a vhost configured as *:443 that will listen on all the IP addresses of the server.