1

I've a very easy question. However I have been digging all the manuals for an answer for a full day already.

What I want is to configure Apache to give anyone read access to /var/www but restrict /var/www/private to my team only. I'm looking for the new solution of version 2.4. Thus not using deprecated directives like Allow, Deny, Order and Satisfy. I have write permission for the /etc/apache2/sites-available/* files but only read permission for /etc/apache2/apache2.conf.

What I've tried so far is this: Content of /etc/apache2/apache2.conf:

<Directory />
    Require all denied
</Directory>
<Directory /var/www>
    Require all granted
</Directory>

Content of /etc/apache2/sites-available/000-default.conf:

<Directory /var/www/private>
    Require group team
</Directory>

But with this configuration everyone has access to /var/www/private. And this I can understand, since Apache merges all the environments for /var/www/private to something like this:

Require all denied  # inherited from /
Require all granted # inherited from /var/www
Require group team  # inherited from /var/www/private

And since Require directives outside <RequireAll>, <RequireAny> or <RequireNone> are equivalent to being in a <RequireAny> block, the merged view is thus:

<RequireAny>
    Require all denied  # inherited from /
    Require all granted # inherited from /var/www
    Require group team  # inherited from /var/www/private
</RequireAny>

And this shows clearly why /var/www/private is open for everyone (the second statement always matches).

My question is thus: "Can you somehow overide the Require all granted in a parent directory in a subdirectory or can you change the default <RequireAny> behaviour to <RequireAll>?"

  • There's no reason require group team won't do what you want except you need to create the group in a htpasswd file (system group doesn't apply) and the users need to login with their user/pass. – Alxs Nov 12 '17 at 13:04
  • Require directives default to RequireAny so it can usually be omitted unless you need to change it. – Alxs Nov 12 '17 at 13:05
2

The default Apache settings for /var/www meet your requirements already. You can restrict access to /var/www/private using Require group team as you suggested, by adding the missing configuration as follows.

Require directives default to RequireAny so it can usually be omitted unless you need to change it as shown in the configuration below.

Create a .groups file like this in a suitable location for your system:

# group: memberOne memberTwo memberThree etc
team: richard david jane bill

Then generate a .password file of users and hashed passwords:

$ htpasswd -c /path/to/file/.passwords richard

Run the same command for each group member who needs access, but omit the -c (create) flag or you'll overwrite the password file with a new blank one.

Configure your Apache directives as follows, setting the correct path to the .passwords and .groups files you created above.

<Location /private>
Options Indexes
  AuthType basic
  AuthName "login info required"
  AuthUserFile path/to/file/.passwords
  AuthGroupFile path/to/file/.groups
<RequireAll>
  Require all granted
  Require group team
</RequireAll>
</Location>

Restart Apache and you're done.

  • I know how to create groups. I just left them out for brevity. The problem with leaving out the <Directory /var/www> section is that I don't have write access to apache2.conf. I'm on a shared hosting where I can only modify the VirtualHost file. – Richard Brinkman Nov 12 '17 at 15:19
  • I don't see the problem with /var/www. The default configuration appears what you want for that directory, so you can leave it alone. Just add the <Directory "/var/www/private"> section to the virtual host's file above/outside of the VirtualHost directive and you're good to go. – Alxs Nov 12 '17 at 15:48
  • The problem at my host is that apache2.conf does have the <Directory /var/www> Require all granted</Directory> in there by default. I cannot change that. Therefore my question, how to revoke access rights for subdirectories. – Richard Brinkman Nov 12 '17 at 16:30
  • My example does exactly that (revokes access rights for sub-directories). The Require group team directive takes precedence over the Require all granted directive on the parent directory. – Alxs Nov 12 '17 at 16:43
  • I tried your answer. I had to change filenames because they don't correspond with your commands. With your example I can browse to localhost/private/index.html. I'm not asked for any password, but see the content. This is the exact behaviour in my original question. Unfortunately, your answer is thus not helpfull. – Richard Brinkman Nov 12 '17 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.