I'm a tad confused after reading these docs:

I wrote this site definition:

$ cat /etc/apache2/sites-enabled/adminer.conf
Alias /adminer  "/var/www/adminer.php"

<Location "/adminer">
        <RequireAny>
                Require local
                Require ip 192.168
                Require ip 10
        </RequireAny>
</Location>

I restart Apache:

$ sudo service apache2 restart

and yet from a WAN situated PC I can still load:

https://example.com/adminer

I am bamboozled I admit and presume I am misunderstanding something or have misread something in the above mentioned docs. If anyone can point me in the right direction here I would be most appreciative. I would rather have access to adminer only from within the LAN and not open it up to attacks from the WAN.

EDIT: I do see this in /etc/apache2/apache2.conf:

<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>

Can that have a higher priority perhaps than my Location specifier?

  • The RequireAny in this case can be omitted. If you have several Require directives they are by default RequireAny. – Stephen Ostermiller Jun 20 at 1:41
  • Do you have any other Require directives or any old style directives such as Order, Deny, Allow, or Satisfy? Even the ones for the root directory location might be relevant. – Stephen Ostermiller Jun 20 at 1:43
  • 1
    I do see this in /etc/apache2/apache2.conf: <Directory /var/www/> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> Can that have a higher priority perhaps than my Location specifier? – Bernd Wechner Jun 20 at 3:10
up vote 2 down vote accepted

I think the "problem" is with your Alias directive.

Whilst the <Location> directive would ordinarily override the <Directory> directive, since it is processed later. When there is an Alias, the <Location> directive is processed before the Alias is evaluated, so the <Directory> container that relates to the Alias target ends up being processed later. In your case, the relevant <Directory> container has a Require all granted directive, so access is ultimately granted.

From the Apache docs for the Alias directive:

Note that you may need to specify additional <Directory> sections which cover the destination of aliases. Aliasing occurs before <Directory> sections are checked, so only the destination of aliases are affected. (Note however <Location> sections are run through once before aliases are performed, so they will apply.)

UPDATE: You should be able to use a <Files> directive, as you suggest in comments, so it's not clear why this would not work for you. For example:

<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
<Files adminer.php>
    <RequireAny>
        Require local
        Require ip 192.168
        Require ip 10
    </RequireAny>
</Files>
</Directory>

I'm assuming all these directives are ending up in the main server config? In which case, the order they are included could be important. Ideally, you would be creating a <VirtualHost> container for this one site, which then makes it easier to override the server config.

Note also, that you shouldn't generally be using <Location> directives to control access to local filesystem resources, as they could be easily circumvented. For example, in your case, the user could simply access /adminer.php directly. As noted in the Apache docs:

<Location> sections operate completely outside the filesystem. This has several consequences. Most importantly, <Location> directives should not be used to control access to filesystem locations. Since several different URLs may map to the same filesystem location, such access controls may by circumvented.

  • Thanks very much for the insight. It's been many years since I worked at length with Apache. Alas you leave open the question of how to solve my problem. Reason being, I'm tempted to conclude that a <Files "adminer.php"> section would work (as that has naught to do with the Alias, but alas I ended up trying the <Location> directive because the <Files> one failed to deliver results as well. It looks like I didn't read the doc well enough on Alias but with your very helpful pointer here I have and I can't see an example with <Files> only with <Directory>. – Bernd Wechner Jun 20 at 10:46
  • A <Files> container should work. Note also that there are security risks with using <Location> directives to control access. I've updated my answer. – DocRoot Jun 20 at 15:21
  • That works, though I am still pulling my hair out understanding this nuance. If I put that into /etc/apache2/apache2.conf, it works, it blocks access from the WAN. Tick. But if I split it so that the <Files> bit is in /etc/apache2/sites-enabled/adminer.conf, then it does not work! I mean I'd prefer to keep those configs together, and am mighty bamboozled. – Bernd Wechner Jun 21 at 3:58

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.