2

How can I configure restriction for URL generated by opencms application on Apache Tomcat?

I tried

<Location "/cs/intranet">
order deny,allow
deny from all
allow from XXX.XXX.XXX.XXX
</Location>

But folder does not exist physically, just url.

http://DOMAIN/cs/intranet

Edit.

Something like this?

<RequireAll "/cs/intranet">
    Require all denied
    Require ip XXX.XXX.XXX.XXX
</RequireAll>
4
  • 1
    What you tried looks like configuration for Apache server, not for Tomcat. Tomcat configuration is pure XML as far as I know. Is your Tomcat server running as a backend behind an Apache reverse proxy? Sep 30, 2019 at 16:01
  • @StephenOstermiller Yes, it is running as a backend behind an Apache reversy proxy.
    – genderbee
    Sep 30, 2019 at 18:25
  • What version of Apache? The order and deny are for Apache 2.2 and earlier. Apache 2.4 and later should use the require keyword. See httpd.apache.org/docs/2.4/howto/access.html There is a backwards compatibility module for 2.4 but I've only gotten it to work in .htaccess. If you are making those changes in a .conf file under 2.4, you'll need the new syntax. Which file did you try that in? Sep 30, 2019 at 18:53
  • @StephenOstermiller Server version: Apache/2.4.7 (Ubuntu). I don't understand how can I use Require for my issue? No .htaccess file is possible, just conf. See my edit. Thanks.
    – genderbee
    Sep 30, 2019 at 20:03

2 Answers 2

1

It should be as simple as:

<Location "/cs/intranet">
    require ip XXX.XXX.XXX.XXX
</Location>

The Upgrading to 2.4 from 2.2 - Apache HTTP Server Version 2.4 document gives a similar example of upgrading from:

Order Deny,Allow
Deny from all
Allow from example.org

to:

Require host example.org

because the default under 2.4 if it doesn't meet the requirement, the request is denied.

Your use of <Location> is correct. According to the core documentation that is to match the URL, and not necessarily a directory in the file system.

1
  • Thanks, but seems it is not working. I tried various combinations and site is still accessible.
    – genderbee
    Oct 1, 2019 at 7:24
1

At the end, ProxyMatch is the way to do it.

<ProxyMatch "/cs/interni" >
    Order Deny,Allow
    Deny from all
    Allow from XXX.XXX.XXX.XXX
</ProxyMatch>

Thanks to all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.