3

I have asked this question on apache mailing-list but I didn't get the answer I want.

I want to allow a directory " /var/www/html/ldap" to two users according to IPs (192.168.1.2 192.168.1.7):

<Directory /var/www/html/ldap>
      Order allow,deny
      Allow from 192.168.1.2 192.168.1.7
      Satisfy any
      AuthName "LDAP Authentication"
      AuthType Basic

      AuthBasicProvider ldap
      AuthzLDAPauthoritative off
      AuthLDAPURL ldap://192.168.1.3/dc=example,dc=com?uid?sub?(objectClass=*)
      Require valid-user
</Directory>

but I don't want to allow a sub directory to 192.168.1.7 (I want it to be allowed only to 192.168.1.2):

I have tried to add:

<Directory /var/www/html/ldap/manager>
      Order allow,deny
      Allow from 192.168.1.2
      Satisfy any
      AuthName "LDAP Authentication"
      AuthType Basic

      AuthBasicProvider ldap
      AuthzLDAPauthoritative off
      AuthLDAPURL ldap://192.168.1.3/dc=example,dc=com?uid?sub?(objectClass=*)
      Require valid-user
</Directory>

but it seems that 192.168.1.7 can reach to manager directory because it is a part of ldap directory, how can I forbid this?

UPDATE:

as Raza suggest I have tried to something like that:

for the main directory:

 <Directory /var/www/html/ldap>
          Order allow,deny
          Allow from 192.168.1.2 192.168.1.7
          Satisfy any
          AuthName "LDAP Authentication"
          AuthType Basic

          AuthBasicProvider ldap
          AuthzLDAPauthoritative off
          AuthLDAPURL ldap://192.168.1.3/dc=example,dc=com?uid?sub?(objectClass=*)
          Require valid-user
    </Directory>

for the sub-directory:

 <Directory /var/www/html/ldap/manager>
          Order Deny,Allow
          Deny From All
          Allow From 192.168.1.2
          Satisfy any
          AuthName "LDAP Authentication"
          AuthType Basic

          AuthBasicProvider ldap
          AuthzLDAPauthoritative off
          AuthLDAPURL ldap://192.168.1.3/dc=example,dc=com?uid?sub?(objectClass=*)
          Require valid-user
    </Directory>

Note:

I don't want to be asked for authentication(LDAP AUTH) for both 192.168.1.2 and 192.168.1.7 on both directories (main-directory and sub-directory).

3
  • are you using apache 2.2 or 2.4? In case of 2.2 here a useful link were the example is similar to your problem, I think the directive order is the point. If you are using 2.4, consider to add RequireAny and Require ip in conjunction Require valid user. Here is useful page
    – Lety
    Aug 1 '14 at 21:39
  • unfortunately I use 2.2 version, I try to update it to 2.4 but I didn't find a useful tutorial to do this, can you provide me with useful one @Letizia
    – Nidal
    Aug 1 '14 at 21:42
  • here is useful link on upgrading 2.2 to 2.4. Did you try to put Require valid-user before Order Allow Deny as suggested in link above?
    – Lety
    Aug 1 '14 at 22:06
3
+50

How about using a re-write rule to block the 192.168.1.7 system from reaching the subdirectory?

RewriteEngine on
RewriteCond   %{REMOTE_ADDR}   ^192\.168\.1\.7$  [NC]
RewriteCond   %{REQUEST_URI}   ^/ldap/manager/.* [NC]
RewriteRule   ^(.*)$           -                 [R=404,L]

Edited from the original answer; this now sends back a 'forbidden' error code.

1
  • Thanks for your answer but How can I direct the user to the error page, and can you provide a source. @Doug O'Neal
    – Nidal
    Jul 29 '14 at 9:58
3

You can create .htaccess with the following option, file in a directory that you do not want to show the listing.

     Order Deny,Allow
     Deny From All
     Allow From 192.168.1.2

steps:

cd /var/www/html/ldap/manager
vi .htaccess (use your favorite editor)
copy/past the following :
    Order Deny,Allow
    Deny From All
    Allow From 192.168.1.2
4
  • Thanks for your reply, can yo explain it to me ,and how can I deploy it to my problem @Raza
    – Nidal
    Jul 23 '14 at 18:35
  • should I add the option inside the <Directory /var/www/html/ldap/manager>
    – Nidal
    Jul 23 '14 at 18:44
  • you are creating a file called .htaccess on the subdirectory where you want limit the access
    – Raza
    Jul 23 '14 at 18:45
  • I have tested what you suggest but it didn't work, the reason is manager directory it is a part of ldap directory. @Raza
    – Nidal
    Jul 24 '14 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.