How to configure Apache to require basic auth AND respect directory and file restrictions? Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern) Come Celebrate our 10 Year Anniversary!Apache2 “Require all granted” doesn't workPHPINFO creates Permission Denied in error logSpecify which directores to look for .htaccess fileApache doesn't respect “Require host”, but “Require ip” worksApache access control not behaving as expectedApache require valid-user only working with one url on same directoryapache virtualhost setup: serving files from directory if exist, fallback to reverse proxyingHow to only allow “Require all denied” in .htaccess?How to deny access to subdirectory in Apache 2.4 using apache2.conf?Apache appears to be ignoring my .htaccess file, despite mod_rewrite being enabled and AllowOveride all
Why do C and C++ allow the expression (int) + 4*5?
How is an IPA symbol that lacks a name (e.g. ɲ) called?
“Since the train was delayed for more than an hour, passengers were given a full refund.” – Why is there no article before “passengers”?
What helicopter has the most rotor blades?
Is my guitar’s action too high?
Why these surprising proportionalities of integrals involving odd zeta values?
Recursive calls to a function - why is the address of the parameter passed to it lowering with each call?
A German immigrant ancestor has a "Registration Affidavit of Alien Enemy" on file. What does that mean exactly?
Who's this lady in the war room?
Should man-made satellites feature an intelligent inverted "cow catcher"?
How to mute a string and play another at the same time
What is the definining line between a helicopter and a drone a person can ride in?
Why did Israel vote against lifting the American embargo on Cuba?
Converting a text document with special format to Pandas DataFrame
tabularx column has extra padding at right?
Does Prince Arnaud cause someone holding the Princess to lose?
Who can become a wight?
Putting Ant-Man on house arrest
What is the evidence that custom checks in Northern Ireland are going to result in violence?
/bin/ls sorts differently than just ls
Are Flameskulls resistant to magical piercing damage?
Why are two-digit numbers in Jonathan Swift's "Gulliver's Travels" (1726) written in "German style"?
What documents does someone with a long-term visa need to travel to another Schengen country?
Can I take recommendation from someone I met at a conference?
How to configure Apache to require basic auth AND respect directory and file restrictions?
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Apache2 “Require all granted” doesn't workPHPINFO creates Permission Denied in error logSpecify which directores to look for .htaccess fileApache doesn't respect “Require host”, but “Require ip” worksApache access control not behaving as expectedApache require valid-user only working with one url on same directoryapache virtualhost setup: serving files from directory if exist, fallback to reverse proxyingHow to only allow “Require all denied” in .htaccess?How to deny access to subdirectory in Apache 2.4 using apache2.conf?Apache appears to be ignoring my .htaccess file, despite mod_rewrite being enabled and AllowOveride all
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
Consider this configuration excerpt from an Apache 2.4.6 (CentOS) setup:
<FilesMatch "^.(.*)$">
Require all denied
</FilesMatch>
<VirtualHost *:443>
ServerName example.com
DocumentRoot /var/www
<Location /admin>
AuthType Basic
AuthName "Please enter your username and password"
AuthUserFile /some/path/to/.htpasswd
Require valid-user
</Location>
<Directory /var/www/admin/uploads>
<Files *.php>
Require all denied
</Files>
</Directory>
</VirtualHost>
Dot and .php files are accessible under /admin providing authentication has succeeded. If /admin is not an actual directory (and we can't use a <Directory> block), how can this be configured to respect the dot and php file restrictions?
I have read https://httpd.apache.org/docs/2.4/sections.html and understand the order in which the configurations apply:
<Directory>(except regular expressions) and .htaccess done simultaneously (with .htaccess, if allowed, overriding<Directory>)
<DirectoryMatch>(and<Directory "~">)
<Files>and<FilesMatch>done simultaneously
<Location>and<LocationMatch>done simultaneously
<If>
So <Location> is overriding <Directory> and <FilesMatch>, presumably the Require valid-user is negating the effects of Require all denied? If so, how can we say in the <Location> match require a valid user and respect the other conditions?
apache-2.4
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
add a comment |
Consider this configuration excerpt from an Apache 2.4.6 (CentOS) setup:
<FilesMatch "^.(.*)$">
Require all denied
</FilesMatch>
<VirtualHost *:443>
ServerName example.com
DocumentRoot /var/www
<Location /admin>
AuthType Basic
AuthName "Please enter your username and password"
AuthUserFile /some/path/to/.htpasswd
Require valid-user
</Location>
<Directory /var/www/admin/uploads>
<Files *.php>
Require all denied
</Files>
</Directory>
</VirtualHost>
Dot and .php files are accessible under /admin providing authentication has succeeded. If /admin is not an actual directory (and we can't use a <Directory> block), how can this be configured to respect the dot and php file restrictions?
I have read https://httpd.apache.org/docs/2.4/sections.html and understand the order in which the configurations apply:
<Directory>(except regular expressions) and .htaccess done simultaneously (with .htaccess, if allowed, overriding<Directory>)
<DirectoryMatch>(and<Directory "~">)
<Files>and<FilesMatch>done simultaneously
<Location>and<LocationMatch>done simultaneously
<If>
So <Location> is overriding <Directory> and <FilesMatch>, presumably the Require valid-user is negating the effects of Require all denied? If so, how can we say in the <Location> match require a valid user and respect the other conditions?
apache-2.4
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
add a comment |
Consider this configuration excerpt from an Apache 2.4.6 (CentOS) setup:
<FilesMatch "^.(.*)$">
Require all denied
</FilesMatch>
<VirtualHost *:443>
ServerName example.com
DocumentRoot /var/www
<Location /admin>
AuthType Basic
AuthName "Please enter your username and password"
AuthUserFile /some/path/to/.htpasswd
Require valid-user
</Location>
<Directory /var/www/admin/uploads>
<Files *.php>
Require all denied
</Files>
</Directory>
</VirtualHost>
Dot and .php files are accessible under /admin providing authentication has succeeded. If /admin is not an actual directory (and we can't use a <Directory> block), how can this be configured to respect the dot and php file restrictions?
I have read https://httpd.apache.org/docs/2.4/sections.html and understand the order in which the configurations apply:
<Directory>(except regular expressions) and .htaccess done simultaneously (with .htaccess, if allowed, overriding<Directory>)
<DirectoryMatch>(and<Directory "~">)
<Files>and<FilesMatch>done simultaneously
<Location>and<LocationMatch>done simultaneously
<If>
So <Location> is overriding <Directory> and <FilesMatch>, presumably the Require valid-user is negating the effects of Require all denied? If so, how can we say in the <Location> match require a valid user and respect the other conditions?
apache-2.4
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
Consider this configuration excerpt from an Apache 2.4.6 (CentOS) setup:
<FilesMatch "^.(.*)$">
Require all denied
</FilesMatch>
<VirtualHost *:443>
ServerName example.com
DocumentRoot /var/www
<Location /admin>
AuthType Basic
AuthName "Please enter your username and password"
AuthUserFile /some/path/to/.htpasswd
Require valid-user
</Location>
<Directory /var/www/admin/uploads>
<Files *.php>
Require all denied
</Files>
</Directory>
</VirtualHost>
Dot and .php files are accessible under /admin providing authentication has succeeded. If /admin is not an actual directory (and we can't use a <Directory> block), how can this be configured to respect the dot and php file restrictions?
I have read https://httpd.apache.org/docs/2.4/sections.html and understand the order in which the configurations apply:
<Directory>(except regular expressions) and .htaccess done simultaneously (with .htaccess, if allowed, overriding<Directory>)
<DirectoryMatch>(and<Directory "~">)
<Files>and<FilesMatch>done simultaneously
<Location>and<LocationMatch>done simultaneously
<If>
So <Location> is overriding <Directory> and <FilesMatch>, presumably the Require valid-user is negating the effects of Require all denied? If so, how can we say in the <Location> match require a valid user and respect the other conditions?
apache-2.4
apache-2.4
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
asked Apr 16 at 11:44
jamieburchelljamieburchell
82
82
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f963279%2fhow-to-configure-apache-to-require-basic-auth-and-respect-directory-and-file-res%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f963279%2fhow-to-configure-apache-to-require-basic-auth-and-respect-directory-and-file-res%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
