Questions[mod-authz-host](server)

I have the following in my apache config file:

Define THUMBS_ROOT "//mysmbserver/website/thumbs"
Alias "/thumbs" "//mysmbserver/website/thumbs"
<Directory {THUMBS_ROOT}>
    Options Indexes FollowSymLinks
    <RequireAny>
        Require ip 66.54.56.34
        Require ip 159.101.84.4
    </RequireAny>
</Directory>
LoadModule authz_core_module modules/mod_authz_core.so

My apache version is Apache/2.4.29 (Win64). (Yes I realise this is an old version of Apache - I can't upgrade due to it being an appliance device)

Even those I've added RequireAny and RequireIP apache is ignoring this and allowing any IP to access the thumbs directory. I can't figure out why. Can anyone help me understand?

Further complicating matters I have a load balancer device sitting in front of apache so really what I need to be looking at is X-Forwarded-For not the source IP. I'm not sure offhand if I need to do anything for RequireIP to detect X-Forwarded-For?

Either way though its allowing access regardless of IP.

Edit: I've also tried:

LoadModule authz_core_module modules/mod_authz_core.so
Define THUMBS_ROOT "//mysmbserver/website/thumbs"
Alias "/thumbs" "//mysmbserver/website/thumbs"

SetEnvIF X-Forwarded-For "66.54.56.34" AllowIP1
SetEnvIF X-Forwarded-For "159.101.84.4" AllowIP2

<Directory {THUMBS_ROOT}>
    Options Indexes FollowSymLinks
    <RequireAny>
        Require env AllowIP1
        Require env AllowIP2
    </RequireAny>
</Directory>

That doesn't work either.

how can set the basic auth of apache 2.2 to bypass IP? I have follow this wiki http://wiki.apache.org/httpd/BypassAuthenticationOrAuthorizationRequirements , but ask always a password, also to IP listed:

<Directory /var/www/html/mydir>
    AuthName "Private"
    AuthType Basic
    AuthUserFile "/etc/httpd/htpasswd"
    Require valid-user
    Order allow,deny
    Allow from 111.111.111.111 222.222.222.222
    Satisfy any
</Directory>

I am under haproxy but i set the IP forward, i have set LogFormat in this way:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

access_log is:

111.111.111.111 - - [25/Oct/2016:12:35:41 +0200] "GET /index.html HTTP/1.1" 401 487 "-" "Mozilla/5.0 (X11; Linux armv7l; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.7.0"

We currently have an SVN repository setup and want to switch over to GIT, but we're currently not sure what exact GIT setup will work for us.

We're currently using SVN (w/ Authz) + Apache (w/ WebDAV & LDAP). We use Authz for SVN since we need fine access control to subdirectories in our repository (not every user should read/write all directories).

Is there a way to port this Authz permission file, so that the GIT repository uses this permission control? Or is there any other way we can control the permissions to GIT with a single file? Keep in mind that we have already LDAP installed, so the permission file should simply map usernames to authorized directories.

I am running CentOS 5.5 with the stock Apache httpd-2.2.3.

I have enabled mod_status at the Location /server-status. I would like to allow access to this single Location in the following way:

1. Deny from all
2. Allow from the subnet 192.168.16.0/24
3. Deny from a the IP 192.168.16.100, which is within the 192.168.16.0/24 subnet.

1 & 2 are easy. However, since I "Allow from 192.168.16.0/24", is it possible to Deny from 192.168.16.100?

I tried to add a Deny statement for 192.168.16.100 but it doesn't work. Here is the relevant config:

<Location /server-status>
    SetHandler server-status
    Order Allow,Deny
    Deny from  all
    Deny from  192.168.16.100 # This does not deny access from 192.168.16.100
    Allow from 192.168.16.0/24
</Location>

Or:

<Location /server-status>
    SetHandler server-status
    Order Allow,Deny
    Deny from  all
    Deny from  192.168.16.100 # This does not deny access from 192.168.16.100
    Allow from 192.168.16.0/24
</Location>

However, this doesn't prevent access to this particular page, as demonstrated in the Access logs:

www.example.org 192.168.16.100 - - [11/Mar/2011:16:01:14 -0800] "GET /server-status HTTP/1.1" 200 9966 "-" "

According to the manual for mod_authz_host:

Allow,Deny

First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any matches, the request is rejected

The IP address matches the Deny directive, so shouldn't the request be rejected?

According to the table on the mod_authz_host page, this IP address should "Match both Allow & Deny", and thus the "Final match controls: Denied" rule should apply.

    Match                       Allow,Deny result                   Deny,Allow result
    Match Allow only            Request allowed                     Request allowed
    Match Deny only             Request denied                      Request denied
    No match                    Default to second directive: Denied Default to second directive: Allowed
    Match both Allow & Deny     Final match controls: Denied        Final match controls: Allowed

How can use X-Forwarded-For headers(my proxy ip 10.1.1.x) to allow HTTP query?