how-to-set-allowoverride-all
how-to-set-allowoverride-all
apache-allowoverride-options-directive
what-does-apaches-require-all-granted-really-do
how-do-i-get-apache-to-follow-symlinks

QUESTION
What are the Run-Time Configuration Changes in apache ?

Allow
Allow specifies which requester** can access a given directory**. The requester can be all, an IP address, a domain name, a partial IP address, a network/netmask pair. By default, it is set to all.

AllowOverride
The main goal of AllowOverride is for the manager of main configuration files of apache (the one found in /etc/apache2/ mainly) to decide which part of the configuration may be dynamically altered on a per-path basis by applications.

If you are not the administrator of the server, you depend on the AllowOverride Level that theses admins allows for you. So that they can prevent you to alter some important security settings;

If you are the master apache configuration manager you should always use AllowOverride None and transfer all google_based example you find, based on .htaccess files to Directory sections on the main configuration files. As a .htaccess content for a .htaccess file in /my/path/to/a/directory is the same as a instruction, except that the .htaccess dynamic per-HTTP-request configuration alteration is something slowing down your web server. Always prefer a static configuration without .htaccess checks (and you will also avoid security attacks by .htaccess alterations).

By the way in your example you use and this will always be wrong, Directory instructions are always containing a path, like or or . And of course this cannot be put in a .htaccess as a .htaccess is like a Directory instruction but in a file present in this directory. Of course you cannot alter AllowOverride in a .htaccess as this instruction is managing the security level of .htaccess files.

Problem
I want to set the AllowOverride all But I don't know how to do it. I have found the following code by searching the google and pasted it in .htaccess:

<Directory>
        AllowOverride All
</Directory>
But after pasting it I started receiving "Internal Server Error"

Solution

In case you are on Ubuntu, edit the file /etc/apache2/apache2.conf (here we have an example of /var/www):

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

and change it to;

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

then,

sudo service apache2 restart
You may need to also do sudo a2enmod rewrite to enable module rewrite.

I am trying to understand the following configuration (specific to FollowSymlinks and SymlinksIfOwnerMatch directives) in Directory section of an httpd.conf file:

<Directory "/home">
 Options +All -FollowSymLinks +IncludesNOEXEC -Indexes +MultiViews +SymLinksIfOwnerMatch
 AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
</Directory>

Based on my understanding, it first disables FollowSymLinks and enables SymLinksIfOwnerMatch at the httpd.conf level and it applies to all the files and subdirectories present inside, /home.

The next directive, AllowOverride. By writing "All", it allows all the Directives belonging to FileInfo, AuthConfig, Indexes, Limit to be overriden by .htaccess files.

It explicitly mentions the list of Options that can be overriden by the .htaccess files.

So, it allows SymLinksIfOwnerMatch to be overriden by the .htaccess file.

Is my understanding correct?

Why does it allow SymLinksIfOwnerMatch to be overriden by the .htaccess file if it has explicitly mentioned in the line above that the SymLinksIfOwnerMatch is enabled?

Thanks.

What does Apache's "Require all granted" really do?

what-does-apaches-require-all-granted-really-do

I've just update my Apache server to Apache/2.4.6 which is running under Ubuntu 13.04. I used to have a vhost file that had the following:

<Directory "/home/john/development/foobar/web">
    AllowOverride All 
</Directory>

But when I ran that I got a "Forbidden. You don't have permission to access /"

After doing a little bit of googling I found out that to get my site working again** I needed to add the following line "Require all granted" so that my vhost looked like this**:

<Directory "/home/john/development/foobar/web">
    AllowOverride All 
    Require all granted
</Directory>

I want to know if this is "safe" and does not bring in any security issues. I read on Apache's page that this "mimics the functionality the was previously provided by the 'Allow from all' and 'Deny from all' directives. This provider can take one of two arguments which are 'granted' or 'denied'. The following examples will grant or deny access to all requests."

But it didn't say if this was a security issue of some sort or why we now have to do it when in the past you did not have to.

The access control configuration changed in 2.4, and old configurations aren't compatible without some changes. See here.

If your old config was Allow from all (no IP addresses blocked from accessing the service), then Require all granted is the new functional equivilent.

upgrading

Run-Time Configuration Changes

Any configuration file that uses authorization will likely need changes.

You should review the Authentication, Authorization and Access Control Howto, especially the section Beyond just authorization which explains the new mechanisms for controlling the order in which the authorization directives are applied.

Directives that control how authorization modules respond when they don't match the authenticated user have been removed: This includes AuthzLDAPAuthoritative, AuthzDBDAuthoritative, AuthzDBMAuthoritative, AuthzGroupFileAuthoritative, AuthzUserAuthoritative, and AuthzOwnerAuthoritative. These directives have been replaced by the more expressive RequireAny, RequireNone, and RequireAll.

If you use mod_authz_dbm, you must port your configuration to use Require dbm-group ... in place of Require group ....

Access control
In 2.2, access control based on client hostname, IP address, and other characteristics of client requests was done using the directives Order, Allow, Deny, and Satisfy.

In 2.4, such access control is done in the same way as other authorization checks, using the new module mod_authz_host. The old access control idioms should be replaced by the new authentication mechanisms, although for compatibility with old configurations, the new module mod_access_compat is provided.

Mixing old and new directives
Mixing old directives like Order, Allow or Deny with new ones like Require is technically possible but discouraged. mod_access_compat was created to support configurations containing only old directives to facilitate the 2.4 upgrade. Please check the examples below to get a better idea about issues that might arise.

Here are some examples of old and new ways to do the same access control.

In this example, there is no authentication and all requests are denied.

2.2 configuration:
Order deny,allow
Deny from all
2.4 configuration:
Require all denied
In this example, there is no authentication and all requests are allowed.

2.2 configuration:
Order allow,deny
Allow from all
2.4 configuration:
Require all granted
In the following example, there is no authentication and all hosts in the example.org domain are allowed access; all other hosts are denied access.

2.2 configuration:
Order Deny,Allow
Deny from all
Allow from example.org
2.4 configuration:
Require host example.org
In the following example, mixing old and new directives leads to unexpected results.

Mixing old and new directives: NOT WORKING AS EXPECTED
DocumentRoot "/var/www/html"

AllowOverride None
Order deny,allow
Deny from all

SetHandler server-status
Require local

access.log - GET /server-status 403 127.0.0.1
error.log - AH01797: client denied by server configuration: /var/www/html/server-status
Why httpd denies access to servers-status even if the configuration seems to allow it? Because mod_access_compat directives take precedence over the mod_authz_host one in this configuration merge scenario.

This example conversely works as expected:

Mixing old and new directives: WORKING AS EXPECTED
DocumentRoot "/var/www/html"

AllowOverride None
Require all denied

SetHandler server-status
Order deny,allow
Deny from all
Allow From 127.0.0.1

access.log - GET /server-status 200 127.0.0.1
So even if mixing configuration is still possible, please try to avoid it when upgrading: either keep old directives and then migrate to the new ones on a later stage or just migrate everything in bulk.

In many configurations with authentication, where the value of the Satisfy was the default of ALL, snippets that simply disabled host-based access control are omitted:

2.2 configuration:
# 2.2 config that disables host-based access control and uses only authentication
Order Deny,Allow
Allow from all
AuthType Basic
AuthBasicProvider file
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

2.4 configuration:
# No replacement of disabling host-based access control needed
AuthType Basic
AuthBasicProvider file
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting both criteria:

2.2 configuration:
Order allow,deny
Deny from all
# Satisfy ALL is the default
Satisfy ALL
Allow from 127.0.0.1
AuthType Basic
AuthBasicProvider file
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

2.4 configuration:
AuthType Basic
AuthBasicProvider file
AuthUserFile /example.com/conf/users.passwd
AuthName secure
<RequireAll>
  Require valid-user
  Require ip 127.0.0.1
</RequireAll>

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting either criteria:

2.2 configuration:
Order allow,deny
Deny from all
Satisfy any
Allow from 127.0.0.1
AuthType Basic
AuthBasicProvider file
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

2.4 configuration:
AuthType Basic
AuthBasicProvider file
AuthUserFile /example.com/conf/users.passwd
AuthName secure
# Implicitly <RequireAny>
Require valid-user
Require ip 127.0.0.1

Other configuration changes
Some other small adjustments may be necessary for particular configurations as discussed below.

1. MaxRequestsPerChild has been renamed to MaxConnectionsPerChild, describes more accurately what it does. The old name is still supported.
2. MaxClients has been renamed to MaxRequestWorkers, which describes more accurately what it does. For async MPMs, like event, the maximum number of clients is not equivalent than the number of worker threads. The old name is still supported.
3. The DefaultType directive no longer has any effect, other than to emit a warning if it's used with any value other than none. You need to use other configuration settings to replace it in 2.4.
4. AllowOverride now defaults to None.
5. EnableSendfile now defaults to Off.
6. FileETag now defaults to "MTime Size" (without INode).
7. mod_dav_fs: The format of the DavLockDB file has changed for systems with inodes. The old DavLockDB file must be deleted on upgrade.
8. KeepAlive only accepts values of On or Off. Previously, any value other than "Off" or "0" was treated as "On".
9. Directives AcceptMutex, LockFile, RewriteLock, SSLMutex, SSLStaplingMutex, and WatchdogMutexPath have been replaced with a single Mutex directive. You will need to evaluate any use of these removed directives in your 2.2 configuration to determine if they can just be deleted or will need to be replaced using Mutex.
10. mod_cache: CacheIgnoreURLSessionIdentifiers now does an exact match against the query string instead of a partial match. If your configuration was using partial strings, e.g. using sessionid to match /someapplication/image.gif;jsessionid=123456789, then you will need to change to the full string jsessionid.
11. mod_cache: The second parameter to CacheEnable only matches forward proxy content if it begins with the correct protocol. In 2.2 and earlier, a parameter of '/' matched all content.
12. mod_ldap: LDAPTrustedClientCert is now consistently a per-directory setting only. If you use this directive, review your configuration to make sure it is present in all the necessary directory contexts.
13. mod_filter: FilterProvider syntax has changed and now uses a boolean expression to determine if a filter is applied.
14. mod_include:
15. The #if expr element now uses the new expression parser. The old syntax can be restored with the new directive SSILegacyExprParser.
16. An SSI* config directive in directory scope no longer causes all other per-directory SSI* directives to be reset to their default values.
17. mod_charset_lite: The DebugLevel option has been removed in favour of per-module LogLevel configuration.
18. mod_ext_filter: The DebugLevel option has been removed in favour of per-module LogLevel configuration.
19. mod_proxy_scgi: The default setting for PATH_INFO has changed from httpd 2.2, and some web applications will no longer operate properly with the new PATH_INFO setting. The previous setting can be restored by configuring the proxy-scgi-pathinfo variable.
20. mod_ssl: CRL based revocation checking now needs to be explicitly configured through SSLCARevocationCheck.
21. mod_substitute: The maximum line length is now limited to 1MB.
22. mod_reqtimeout: If the module is loaded, it will now set some default timeouts.
23. mod_dumpio: DumpIOLogLevel is no longer supported. Data is always logged at LogLevel trace7.
24. On Unix platforms, piped logging commands configured using either ErrorLog or CustomLog were invoked using /bin/sh -c in 2.2 and earlier. In 2.4 and later, piped logging commands are executed directly. To restore the old behaviour, see the piped logging documentation.

25. top
    Misc Changes

26. mod_autoindex: will now extract titles and display descriptions for .xhtml files, which were previously ignored.

27. mod_ssl: The default format of the *_DN variables has changed. The old format can still be used with the new LegacyDNStringFormat argument to SSLOptions. The SSLv2 protocol is no longer supported. SSLProxyCheckPeerCN and SSLProxyCheckPeerExpire now default to On, causing proxy requests to HTTPS hosts with bad or outdated certificates to fail with a 502 status code (Bad gateway)

28. htpasswd now uses MD5 hash by default on all platforms.

29. The NameVirtualHost directive no longer has any effect, other than to emit a warning. Any address/port combination appearing in multiple virtual hosts is implicitly treated as a name-based virtual host.

30. mod_deflate will now skip compression if it knows that the size overhead added by the compression is larger than the data to be compressed.

31. Multi-language error documents from 2.2.x may not work unless they are adjusted to the new syntax of mod_include's #if expr= element or the directive SSILegacyExprParser is enabled for the directory containing the error documents.

32. The functionality provided by mod_authn_alias in previous versions (i.e., the AuthnProviderAlias directive) has been moved into mod_authn_core.

33. The RewriteLog and RewriteLogLevel directives have been removed. This functionality is now provided by configuring the appropriate level of logging for the mod_rewrite module using the LogLevel directive. See also the mod_rewrite logging section.

34. top
    Third Party Modules
    All modules must be recompiled for 2.4 before being loaded.

Many third-party modules designed for version 2.2 will otherwise work unchanged with the Apache HTTP Server version 2.4. Some will require changes; see the API update overview.

top
Common problems when upgrading
Startup errors:

1. Invalid command 'User', perhaps misspelled or defined by a module not included in the server configuration - load module mod_unixd
2. Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration, or Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration - load module mod_access_compat, or update configuration to 2.4 authorization directives.
3. Ignoring deprecated use of DefaultType in line NN of /path/to/httpd.conf - remove DefaultType and replace with other configuration settings.

4. Invalid command 'AddOutputFilterByType', perhaps misspelled or defined by a module not included in the server configuration - AddOutputFilterByType has moved from the core to mod_filter, which must be loaded.
   Errors serving requests:

5. configuration error: couldn't check user: /path - load module mod_authn_core.

6. .htaccess files aren't being processed - Check for an appropriate AllowOverride directive; the default changed to None in 2.4.
   

I don't think it this is equivalent to Allow from all. You have to "merge" Require all granted with other existing Require rules. In my case an existing Require valid-user was ignored when blindly converting the config like it's recommended everywhere. This was the worst thing which could happen

n Apache 2.2 would be like:

<Location />
   Order deny, allow
   allow from all
</Location>
<Location /adm>
    Order deny, allow
    deny from all
    allow from myniceip
</Location>
<Location /disabled>
    Order deny, allow
    deny from all
</Location>

In Apache 2.4 would be like:

<Location />
   require all granted
</Location>

Note that you dont need to use require all denied

to require only a group of ips..

<Location /adm>
    require ip myniceip
</Location>
<Location /disabled>
    Require all denied
</Location>