Topic: apache 2.4 and mod_access_compat

[AndreL]

Hi,

I just migrated from apache 2.2 to 2.4.3 using the mod_access_compat module. No issue for that first step.

I have some troubles to convert the autorisation to the new format.

Old format:
<Directory "C:/Web/intranet">
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
AuthType Basic
AuthName "Intranet"
AuthUserFile ./conf/auth.psw
Require valid-user
Satisfy Any
</Directory>

My translated format:
<Directory "C:/Web/intranet">
AuthType Basic
AuthName "Intranet"
AuthUserFile ./conf/auth.psw
Require IP 192.168.1.0/24
Require valid-user
</Directory>

The latest is not working...

NB: could I use the new way of working for some sections keeping others on the former format with mod_access_compat

Thanks for your help,
André.

[Steffen]

Yep, for me it is also mostly puzzling with the new require in 2.4.

In your config the requires are OR-ed.

You may want to try:

<Directory "C:/Web/intranet">
AuthType Basic
AuthName "Intranet"
AuthUserFile ./conf/auth.psw
<RequireAll>
Require IP 192.168.1.0/24
Require valid-user
</RequireAll>
</Directory>

When that is not working either, you can try:

<RequireAll>
Require all denied
Require IP 192.168.1.0/24
Require valid-user
</RequireAll>

[dreuzel]

It makes no sence to have an apache and not being able to secure a website with password, ip, host security.

I've installed and tried 2.4.3 just to notice all security seems to fail, Whatever I try I do notget
aany protection or a full block the site. I can not get it under controll,

What I want is basic and simple : I use DBD odbc access controll. All queries exist since ages and always where correct.
<Directory /secure>
Authtype Digest
AuthDIgestProvider dbd
require valid-user
</directory>

tried
require dbd-user
encapsuled <RequireAll>
added Satisfy all

....
I can only access based on
required ip but I need a username and group securit in my application .....


Please help me ?
Is the code broken
for such a simple requirement it should be easy and straightforward no ?

If something that simple in requirement seems to fail unexplicably can I ever rely on Apache security again ???