Apache , Httpd.conf, deny

[CapnPugwash]

Hi,

 

I'm running Ubuntu 12.04 as a webserver. I'm trying to restrict access to a folder by adding a rule to httpd.conf

The only users I want to be able to access this folder are on the local LAN, where all IP addresses begin with 123.456

 

Order Allow,Deny

Allow from 123.456

 

From what I understand, access should be denied by default & only IP addresses that start with '123.456' should be allowed

 

This isn't working. The rule blocks everything. if I change the Allow rule to a full IP address it's still the same...

 

I'm all ears for ideas!!

[pcstru]

Do you have AllowOverride set at the web root or virtual host level?

[CapnPugwash]

I inherited this server so it's a bit of a mystery to me. I have a number of sites (including a staff and student intranet) . Each site has a virtual host file containing this code:

 

Options FollowSymLinks

AllowOverride None

 

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from all

 

As an experiment I stripped out both these directives and replaced them with:

 

# Intranet settings

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from 123.456

 

This *should* restrict access to the intranet folder to only local network addresses. I'm not sure if it's working as it should but it's certainly not stopping anyone (on the local network) from accessing the site.

 

If I drop almost the same settings into the web page virtual host file

 

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from 123.456

 

I get a 'Forbidden - You don't have permission to access /folderName/ on this server' when I try and access it from a local network address (beginning with 123.456) If I change 'allow from 123.456' to 'allow from all' - it lets me in.

 

If there is an 'AllowOverride' somewhere else on my server that is stopping this from working, it doesn't make sense to me that I can toggle between 'everyone can access this folder' and 'no-one can access this folder'

 

If I'm being dim here, let me know!

[pcstru]

I can't see a problem (although obviously there is one) - I'm assuming your 123.456 is a valid IP and not actually 123.456! I'd probably try setting AllowOveride Limit and then using allow in an .htaccess file. Also what do the logs tell you about the IP the server is actually seeing? Is a proxy perhaps interfering and passing on it's IP rather than the clients?

[CapnPugwash]

Hi, thanks for that

 

I think this is the key : "Is a proxy perhaps interfering and passing on it's IP rather than the clients?" This is just a guess but when I look at the intranet, traffic is being pushed straight through to the server. When I look at the website traffic is being pushed through the proxy server. Probably can be sorted with a DNS entry + host file change...

[CapnPugwash]

Yep, just dropped in an entry into DNS and it works a treat