Apache Security

stu_mueller · 06-03-2008, 03:04 PM

I have just installed apache and in my http.conf file I have enable the http-vhost.conf

I have then added a virtual host with a documentroot of /media/usb/site

when I go to this site I get permission denied.

After playing about with the http.conf file i discover two lines:
Order deny,allow
Deny from all

I changed these to be:
Order allow,deny
Allow from all

and my site started working.

I changed them back to the original and added them into my <virualhost> tag in http-vhosts.conf but after trying to restart httpd it told me those values can't go there, where should I put them, or should I just change the Order and Allow in the default http.conf file

Stuart

Wim Sturkenboom · 06-05-2008, 12:11 AM

Code:

#
# Use name-based virtual hosting.
#
NameVirtualHost *:80

# catch-all
<VirtualHost *:80>
    ServerAdmin a@b.c
    DocumentRoot /srv/httpd/htdocs
    ServerName btd-techweb02
</VirtualHost>

# site 1
<VirtualHost *:80>
    ServerAdmin a@b.c
    DocumentRoot /home/wim/www/site1/web
    ServerName site1.btd-techweb02
    ErrorLog /var/log/httpd/error_log
    CustomLog /var/log/httpd/access_log common

#WimS
# this is required to prevent message 403 "Forbidden"
    <Directory "/home/wim/www/site1/web">
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

# site2
<VirtualHost *:80>
    ServerAdmin a@b.c
    DocumentRoot /home/wim/www/site2/web
    ServerName site2.btd-techweb02
    ErrorLog /var/log/httpd/error_log
    CustomLog /var/log/httpd/access_log common

#WimS
# this is required to prevent message 403 "Forbidden"
    <Directory "/home/wim/www/site2/web">
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

This is how they are in my httpd-vhosts.conf. The documentation in my httpd.conf states that 'we start with a very restrictive setting'. I think that it's always good to start conservative and open up according to your needs.

PS Taken from a standard Slackware 12 install

stu_mueller · 06-05-2008, 04:06 AM

thanks that worked fine.

I agree though it is always best to start restrictive and allow. rather than the other way around