4

im sure, this question looks really stupid first. but i need a "second opinion" on this, even i did some research on my own but i am still unsure about this.

By default the Apache Configuration on CentOS7 and pretty much any Distro i know so far usually denies access recursively to the ROOT Filesystem (/) with a Directory Statement like this:

Default: /etc/httpd/conf/httpd.conf

<Directory />
    AllowOverride none
    Require all denied 
</Directory>

Usually Followed by some Directory Statements (Blocks) that "relaxes" Permissions to the parts of the filesystem that contain html or other web server content.

Now i have to deal with "some Web App" from "some Company" lately that is requesting/requiring the following Change to the apache config file:

Requested by Software Company: /etc/httpd/conf/httpd.conf

<Directory />
    AllowOverride none
    Require all granted
</Directory>

This raised some red flag inside my mind and i tried to research this on the net. not yet found anything stating clearly what this configuration would effectively mean. But i would guess, this grants read access to pretty much any file on the whole Linux Server which can be read by usergroup "other" or the apache service account or service group. So if i am right, it would be a really really baaaaaad idea to ever do something like this on an internet webserver.

am i correct on this assumption? or am i missing something here?

thanks for any hint/tip/explaination on this!

best regards Axel

Improve this question
11
  • Here is the link to the "require all" documentation from Apache's mod_authz_core: httpd.apache.org/docs/2.4/mod/mod_authz_core.html#reqall
    – Stephen Ostermiller ♦
    Jun 14, 2017 at 14:48
  • Just to clarify, the directive does not refer to the file system root, but the root of the web space. As in the URL www.example.com/.
    – closetnoc
    Jun 14, 2017 at 16:10
  • 1
    @closetnoc, I don't think so, the documentation refers to <Directory> as a file system container as opposed to <Location> which is a webroot container.
    – Stephen Ostermiller ♦
    Jun 14, 2017 at 17:42
  • @StephenOstermiller Perhaps I could have been clearer. It is a file system directive, however, it is from the defined web space that represents the web root as in the result of the URL and not from the top of the file system. It all depends on where you define your root such as /home/example.com/ or /var/httpd/HTML/. In other words, you cannot access /var/httpd/ because of the directive, but rather, because of the file system permissions. This directive assumes file level access for the directory defined for the web space. Clear as mud? Cheers!!
    – closetnoc
    Jun 14, 2017 at 17:56
  • 1
    I think I see why the poster was confused about this. Now I'm confused too.
    – Stephen Ostermiller ♦
    Jun 14, 2017 at 18:28

1 Answer 1

Reset to default
3

This is an issue I've ran into a few times & it stems from a change in terminology from Apache 2.2 to Apache 2.4 (detailed here). Access control options that were previously addressed with 'Order X, Allow or Deny from X', can now be managed with 'Require X'. The simplest use case example would be...

Apache 2.2:

Order allow,deny
Allow from all

..on the more recent Apache would equate to...

Apache 2.4:

Require all granted

So basically, Yes - you are correct to assume that this change extensively losens access privledges on your server (holding all else equal of course).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.