2

How can I configure restriction for URL generated by opencms application on Apache Tomcat?

I tried

<Location "/cs/intranet">
order deny,allow
deny from all
allow from XXX.XXX.XXX.XXX
</Location>

But folder does not exist physically, just url.

http://DOMAIN/cs/intranet

Edit.

Something like this?

<RequireAll "/cs/intranet">
    Require all denied
    Require ip XXX.XXX.XXX.XXX
</RequireAll>
Improve this question
4
  • 1
    What you tried looks like configuration for Apache server, not for Tomcat. Tomcat configuration is pure XML as far as I know. Is your Tomcat server running as a backend behind an Apache reverse proxy?
    – Stephen Ostermiller ♦
    Sep 30, 2019 at 16:01
  • @StephenOstermiller Yes, it is running as a backend behind an Apache reversy proxy.
    – genderbee
    Sep 30, 2019 at 18:25
  • What version of Apache? The order and deny are for Apache 2.2 and earlier. Apache 2.4 and later should use the require keyword. See httpd.apache.org/docs/2.4/howto/access.html There is a backwards compatibility module for 2.4 but I've only gotten it to work in .htaccess. If you are making those changes in a .conf file under 2.4, you'll need the new syntax. Which file did you try that in?
    – Stephen Ostermiller ♦
    Sep 30, 2019 at 18:53
  • @StephenOstermiller Server version: Apache/2.4.7 (Ubuntu). I don't understand how can I use Require for my issue? No .htaccess file is possible, just conf. See my edit. Thanks.
    – genderbee
    Sep 30, 2019 at 20:03

2 Answers 2

Reset to default
1

It should be as simple as:

<Location "/cs/intranet">
    require ip XXX.XXX.XXX.XXX
</Location>

The Upgrading to 2.4 from 2.2 - Apache HTTP Server Version 2.4 document gives a similar example of upgrading from:

Order Deny,Allow
Deny from all
Allow from example.org

to:

Require host example.org

because the default under 2.4 if it doesn't meet the requirement, the request is denied.

Your use of <Location> is correct. According to the core documentation that is to match the URL, and not necessarily a directory in the file system.

Improve this answer
1
  • Thanks, but seems it is not working. I tried various combinations and site is still accessible.
    – genderbee
    Oct 1, 2019 at 7:24
1

At the end, ProxyMatch is the way to do it.

<ProxyMatch "/cs/interni" >
    Order Deny,Allow
    Deny from all
    Allow from XXX.XXX.XXX.XXX
</ProxyMatch>

Thanks to all.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.