2017-12-28 Learning Apache 2.4 access control 9 months ago
Before I expose anything to the outside world I want the access controls to work as I expect, but things have changed a lot in Apache 2.4. Standard for a site that's normally available is now in 2.4:<Directory "/home/httpd/idefix/html"> Require all granted </Directory>(and any other needed options). But for development systems I want a username/password request to access them. This part took a bit of work to get right. First I found Upgrading to 2.4 from 2.2 - Apache HTTP Server Version 2.4 has a repeating typo in the authorization samples:AuthBasicProviderisn't going to work, giving
FileUnknown Authn provider: Fileerror messages. The right bit is:AuthBasicProvider fileThe difference one letter makes. That also did not give me a working configuration, leading to interesting errors in the log of type:AH00027: No authentication done but request not allowed without authentication for /. Authentication not configured?Which turned out to be a missing bit in the samples in the same document: the AuthType is needed too. The full now working access rule is:<Location "/"> AuthType Basic AuthBasicProvider file AuthUserFile /home/httpd/data/sitemanagers AuthName "Koos z'n Doos beheer" <RequireAny> Require valid-user </RequireAny> </Location>The use of RequireAny allows me to add trusted IP ranges so that the site is reachable from a trusted IP address or after using http basic authentication. The good news is that the samples in Authentication and Authorization - Apache HTTP Server Version 2.4 are correct.