3

I looked through a number of similar posts, but couldn't find the answer there:

I am moving a website from a server running apache 2.2 to another server running apache 2.4 (CentOS 6 to CentOS 7).

On the old server, I am specifying an error document, redirecting the user to a different site when a certain environment variable is not true:

Works in apache 2.2:

ErrorDocument 403 https://example.com/error_message.html
Include conf/includes/include_file
<Directory /var/www/html> 
   ...
   AllowOverride None
   order deny, allow
   deny from all
   allow from env=variable_set_though_include_file
</Directory>

ErrorDocument part does not work in apache 2.4. The rest of the functionality works as expected. Traffic is allowed when on the correct network, when the user is on the wrong network, s/he gets a 403 error:

ErrorDocument 403 https://example.com/error_message.html
Include conf/includes/include_file
<Directory /var/www/html>
   ... 
   AllowOverride None
   Require all denied
   <RequireAny>
     Require env variable_set_through_include_file
   </RequireAny>
</Directory>

The error message I am getting when the environment variable is not true, is: 

Forbidden
You don't have permission to access / on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

The web-page I want to redirect to through the ErrorDocument statement is on a different server (no configuration changes there) and does not have any access restrictions.

Any clue?

Improve this question
4
  • Why do you have a RequireAny statement with only one thing in it?
    – Stephen Ostermiller ♦
    May 1, 2019 at 14:27
  • Have you tried temporarily pasting in the contents of the include file to see if it works when the environment variable is set directly in the file rather than when set in an include? What are the contents of the include file anyway?
    – Stephen Ostermiller ♦
    May 1, 2019 at 14:28
  • Part of the problem may be your Require all denied statement. I don't think you need that statement at all, and it may be causing everything to be denied. See Upgrading from Apache 2.2 to 2.4; access control. It shows an example where denying and then allowing from a host becomes just requiring the host.
    – Stephen Ostermiller ♦
    May 1, 2019 at 14:35
  • The "Require all denied", "RequireAny" part works. I only added it for context. I have used "RequireAny" with only one statement, because I had another requirement in there earlier. Basically, that block lets traffic through when on the correct network, and gives a 403 error when on the wrong network. The part that doesn't work is the ErrorDocument part.
    – Ursula
    May 1, 2019 at 15:58

1 Answer 1

Reset to default
0

Solution:

Apache on CentOS comes with a default welcome.conf file in the conf.d directory. welcome.conf includes an ErrorDocument 403 statement, that overwrites the ErrorDocument 403 statement in the virtual host's configuration file.

Removing welcome.conf would solve the issue temporarily. On apache update, welcome.conf would get recreated.

Commenting out the ErrorDocument 403 line in welcome.conf solved the issue.

In summary: This was not a problem of upgrading from apache 2.2 to apache 2.4, but an issue with precedence. On the old apache 2.2 server, these lines have been commented out, so a previous sysadmin had already figured out the problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.