0

I am running Apache/2.2.22.

I cannot figure out how to properly enforce Apache authentication requirements.

My site has two areas:

  1. Access always requires password authentication (/restricted and /cgi-bin/restricted)
  2. Access can be allowed based on having a local IP address (/local and /cgi-bin/local)

However, I get these behaviors:

  • Access to /restricted/index.html correctly requires authentication
  • Access /cgi-bin/restricted/ correctly requires authentication
  • Access to /cgi-bin/restricted/target.cgi requires NO authentication

All of this testing does occur from the IP addresses allowed to access /local and /cgi-bin/local, so it is possible that this allowance is bleeding over somehow, but it certainly isn't supposed to.

The relevant sections of my VirtualHost configuration are: (Note that I am currently using <Location />s in the cgi-bin section, I previously had all of the requirements inside of the relevant <Directory />s but pulled it out based on other recommendations I found; it had no effect.)

DocumentRoot /var/www

    # HTML section
    <Directory /var/www/restricted>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            AuthType Basic
            AuthName "Restricted"
            AuthBasicProvider file
            AuthUserFile /etc/apache2/passwords
            Require user username
    </Directory>

    <Directory "/var/www/local/">
            Options Indexes FollowSymLinks
            Order allow,deny
            Allow from 192.168.1.0/24
            Allow from 192.168.0.0/24
    </Directory>

    # CGI section
    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

    <Directory "/usr/lib/cgi-bin/resricted">
            AllowOverride None
            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    </Directory>

    <Location "/usr/lib/cgi-bin/restricted">
            AuthType Basic
            AuthName "Restricted"
            AuthBasicProvider file
            AuthUserFile /etc/apache2/passwords
            Order allow,deny
            Require user username
    </Location>

    <Directory "/usr/lib/cgi-bin/local">
            AllowOverride None
            Options +ExecCGI +SymLinksIfOwnerMatch -MultiViews
    </Directory>

    <Location "/usr/lib/cgi-bin/local">
            Order allow,deny
            Allow from 192.168.1.0/24
            Allow from 192.168.0.0/24
    </Location>

1 Answer 1

0
#<Location "/usr/lib/cgi-bin/restricted">
<Location "/cgi-bin/restricted">
#<Location "/usr/lib/cgi-bin/local">
<Location "/cgi-bin/local">

'Location' refers to path in the url, the part after hostname beginning with /, not fs dir.

1
  • wow, thank you. I feel a little dumb.... hahahaha but seriously thank you very much. Commented Feb 3, 2015 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .