httpd-docs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Apache Wiki <wikidi...@apache.org>
Subject [Httpd Wiki] Update of "ClientDeniedByServerConfiguration" by thumbs
Date Thu, 03 Mar 2016 01:47:43 GMT
Dear Wiki user,

You have subscribed to a wiki page or wiki category on "Httpd Wiki" for change notification.

The "ClientDeniedByServerConfiguration" page has been changed by thumbs:
https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration?action=diff&rev1=15&rev2=16

Comment:
Complete rewrite of this recipe for clarity, and added new possible causes.

+ = Client denied by server configuration =
+ This error means that the access to the directory on the file system was denied by an Apache
configuration.
+ 
- = apache HTTP server 2.4 notes =
+ == Apache HTTP server 2.4 notes ==
  The 2.4 release introduced significant changes to the authorization and authentication process.
Users of that release are encouraged to read [[http://httpd.apache.org/docs/2.4/upgrading.html|this
link]] to migrate their older config files.
  
- Using 2.4 and 2.2 authorization directives (enabled by [[http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html|mod_access_compat]])
in the same server instance is strongly discouraged because it can cause unexpected 'Client
Denied by Server Configuration' errors that may be troublesome to resolve. When using 2.4,
please migrate all [[http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html|Allow, Deny,
Order and Satisfy]] directives to the 2.4 equivalent using the information in the link above
and then comment out the [[http://httpd.apache.org/docs/2.4/mod/mod_so.html#loadmodule|LoadModule]]
line for mod_access_compat.
+ == Before you start ==
  
+ Before attempting to alter any existing config file, please take note of the full file system
path for which access is being denied, and the IP or hostname of the client:
- = Client denied by server configuration =
- This error means that the access to the directory on the hard disk was denied by an Apache
configuration. It could be that access was denied due to an explicit [[http://httpd.apache.org/docs/2.2/en/mod/mod_authz_host.html#deny|deny]]
directive or due to an attempt to access a folder that is outside of the DocumentRoot.
- It can also happen when you are proxying and there's no access configured for the proxied
location.  And it is the default response to a PUT request.
- 
- These are some reasons for this entry to be recorded in your !ErrorLog:
- 
-  * The default Apache config includes {{{Deny from all}}} in the <Directory> block
the !DocumentRoot - this must be changed to allow access!
-  * If you change the !DocumentRoot, you will need to change the <Directory> block
referring the old root, to the refer to the new root
-  * You need a <Directory> block for every folder outside of your !DocumentRoot, i.e.
your cgi-bin folder.
-  * You need a <Directory> or <Location> block for every Alias.
-  * You need a <Location> or <Proxy> block for your proxy
- 
- To fix this problem, look at the line in your !ErrorLog, to find out which folder it is
trying to access.   <<BR>> If a <Directory> block already exists for that
folder, make sure it is set to allow access as necessary. If not, add a <Directory>
block to your Apache configuration file, allowing access as required.  See the example below
for folder /usr/local/awstats/htdocs.
  
  {{{
- <Directory /usr/local/awstats/htdocs>
+ 
+ [<date here>] [error] [client ::1] client denied by server configuration: /var/www/example.com/
+ 
+ }}}
+ 
+ Using the correct path in the [[http://httpd.apache.org/docs/current/mod/core.html#directory|directory]]
block for the following examples is essential to solving this problem. In this case, a client
from the local machine (::1) is being denied access to /var/www/example.com .
+ 
+ == Troubleshooting ==
+ 
+ The possible causes are:
+ 
+  * Access was denied due to an explicit [[http://httpd.apache.org/docs/2.2/en/mod/mod_authz_host.html#deny|deny
(2.2)]] directive or [[http://httpd.apache.org/docs/current/mod/mod_authz_core.html#require|require
(2.4)]] directive in a [[http://httpd.apache.org/docs/current/mod/core.html#directory|directory]]
block or .htaccess file.
+ 
+ {{{
+ 
+ DocumentRoot /var/www/example.com
+ 
+ }}}
+ 
+ 2.2:
+ 
+ {{{
+ 
+ <Directory /var/www/example.com>
+   Order deny,allow
+   Deny from all
+ </Directory>
+ 
+ }}}
+ 
+ 2.4:
+ 
+ {{{
+ 
+ <Directory /var/www/example.com>
+   Require all denied
+ </Directory>
+ 
+ }}}
+ 
+ In the above examples, using the following configuration will resolve the issue:
+ 
+ 2.2:
+ 
+ {{{
+ 
+ <Directory /var/www/example.com>
    Order allow,deny
    Allow from all
  </Directory>
+ 
  }}}
- This directory block will allow Apache to serve files from this location, in response to
an incoming request. This assumes either you have an Alias set up somewhere for serving content
from this directory or, less likely, that your !DocumentRoot is /usr/local or /usr/local/awstats.
+ 
+ 2.4:
  
  {{{
+ 
+ <Directory /var/www/example.com>
+   Require all granted
+ </Directory>
+ 
+ }}}
+ 
+  * An attempt to access a directory outside of the DocumentRoot defined by an [[http://httpd.apache.org/docs/current/mod/mod_alias.html#alias|alias]]
without a corresponding [[http://httpd.apache.org/docs/current/mod/core.html#directory|directory]]
block.
+ 
+ {{{
+ 
+ DocumentRoot /var/www/example.com
+ 
+ Alias /foo /var/www/foo
+ 
+ }}}
+ 
+ Solution (2.2):
+ 
+ {{{
+ 
+ <Directory /var/www/foo>
+   Order allow,deny
+   Allow from all
+ </Directory>
+ 
+ }}}
+ 
+ Solution (2.4):
+ 
+ {{{
+ 
+ <Directory /var/www/foo>
+   Require all granted
+ </Directory>
+ 
+ }}}
+ 
+  * Proxying to a service with no explicit access in a [[http://httpd.apache.org/docs/current/mod/core.html#location|location]]
block.
+ 
+ {{{
+ 
- ProxyPass /foo http://internal.foo.com:8900/
+ ProxyPass /foo/ http://internal.example.com:8900/
+ 
- ProxyPassReverse /foo http://internal.foo.com:8900/
+ ProxyPassReverse /foo/ http://internal.example.com:8900/
+ 
+ }}}
+ 
+ Solution (2.2):
+ 
+ {{{
+ 
  <Location /foo>
    Order allow,deny
    Allow from all
  </Location>
+ 
  }}}
- This Location block will allow Apache to proxy content for /foo. This Location block is
only needed if there is earlier Proxy or Location block denying access to this resource. Some
Linux distributions like Debian put Proxy block with "Deny from all" in their default mod_proxy
configuration.
  
- == Example ==
+ Solution (2.4):
+ 
  {{{
- [Fri Jan 16 15:00:42 2009] [error] [client ::1] client denied by server configuration: /var/www/phpmyadmin/
+ 
+ <Location /foo>
+   Require all granted
+ </Location>
+ 
  }}}
- Adding "Allow from 127.0.0.0/255.0.0.0 ::1/128" to the ACL, will prevent the apache internal
process from erroring.
  
+  * A PUT request was received; a 403 is the default response. Access can be granted with
[[http://httpd.apache.org/docs/current/mod/core.html#limitexcept|limitexcept (2.2)]] or [[http://httpd.apache.org/docs/current/mod/mod_allowmethods.html|mod_allowmethods
(2.4)]].
+  * A mix of [[http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow|allow (2.2)]]
and [[http://httpd.apache.org/docs/current/mod/mod_authz_core.html#require|require (2.4)]]
directives while using apache HTTPD 2.4, used in the same or separate [[http://httpd.apache.org/docs/current/mod/core.html#directory|directory]]
blocks. The new 2.4 directives should be used exclusively, and the [[http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html|mod_access_compat]]
module should be unloaded by commenting out the [[http://httpd.apache.org/docs/2.4/mod/mod_so.html#loadmodule|LoadModule]]
directive.
+ 
+ {{{
+ 
+ <Directory /var/www/example.com>
+   Order allow,deny
+   Allow from all
+   Require all granted
+ </Directory>
+ 
+ }}}
+ 
+ The solution:
+ 
+ {{{
+ 
+ <Directory /var/www/example.com>
+   Require all granted
+ </Directory>
+ 
+ }}}
+ 
+  * Using [[http://www.modsecurity.org/projects/modsecurity/apache/index.html|mod_security]]
with an explicit directive to deny access. Altering or commenting out the offending directives
from that module will resolve the issue.
+  * Using a bandwidth or rate limiting module such as [[http://www.zdziarski.com/blog/?page_id=442|mod_evasive]],
[[http://dominia.org/djao/limitipconn2.html|mod_limitipconn]] or [[http://bwmod.sourceforge.net/|mod_bw]].
A capable firewall is far more efficient at limiting traffic bursts, and abusive clients.
+ 
+ == Words of caution ==
+ 
+ The following configuration may be included in your apache HTTPD configuration; its purpose
is to prevent unauthorized access to the root of the file system. Under no condition should
it be altered. Instead, the existing [[http://httpd.apache.org/docs/current/mod/core.html#directory|directory]]
block for the full file system path should be altered, or a new one should be created if it
was not already present.
+ 
+ 2.2:
+ 
+ {{{
+ 
+ <Directory />
+   Order deny,allow
+   Deny from all
+ </Directory>
+ 
+ }}}
+ 
+ 2.4:
+ 
+ {{{
+ 
+ <Directory />
+   Require all denied
+ </Directory>
+ 
+ }}}
+ 
+ == Restricting access a little further ==
+ 
+ If granting full access to the resource in question is not an option, specific IP addresses,
partial IP addresses, network masks and CIDR specifications can be used with the [[http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow|allow]]
and [[http://httpd.apache.org/docs/current/mod/mod_authz_core.html#require|require]] directives.
+ 

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org


Mime
View raw message