Documentation rebuild (311d6c13) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

docs/manual/howto/auth.html.en

+12 −0

Original line number	Diff line number	Diff line
		@@ -564,6 +564,18 @@ Require group GroupName</pre>
		However to provide backwards compatibility for older configurations, these
		directives have been moved to the <code class="module"><a href="../mod/mod_access_compat.html">mod_access_compat</a></code> module.</p>

		<div class="warning"><h3>Note</h3>
		<p>The directives provided by <code class="module"><a href="../mod/mod_access_compat.html">mod_access_compat</a></code> have
		been deprecated by <code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code>.
		Mixing old directives like <code class="directive"><a href="../mod/mod_access_compat.html#order">Order</a></code>, <code class="directive"><a href="../mod/mod_access_compat.html#allow">Allow</a></code> or <code class="directive"><a href="../mod/mod_access_compat.html#deny">Deny</a></code> with new ones like
		<code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code> is technically possible
		but discouraged. The <code class="module"><a href="../mod/mod_access_compat.html">mod_access_compat</a></code> module was created to support
		configurations containing only old directives to facilitate the 2.4 upgrade.
		Please check the <a href="../upgrading.html">upgrading</a> guide for more
		information.
		</p>
		</div>


		</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
		<div class="section">

docs/manual/mod/mod_access_compat.html.en

+9 −3

Original line number	Diff line number	Diff line
		@@ -62,8 +62,14 @@ have been deprecated by the new authz refactoring. Please see

		<div class="warning"><h3>Note</h3>
		<p>The directives provided by <code class="module"><a href="../mod/mod_access_compat.html">mod_access_compat</a></code> have
		been deprecated by the new authz refactoring. Please see
		<code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code>.</p>
		been deprecated by <code class="module"><a href="../mod/mod_authz_host.html">mod_authz_host</a></code>.
		Mixing old directives like <code class="directive"><a href="#order">Order</a></code>, <code class="directive"><a href="#allow">Allow</a></code> or <code class="directive"><a href="#deny">Deny</a></code> with new ones like
		<code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code> is technically possible
		but discouraged. This module was created to support
		configurations containing only old directives to facilitate the 2.4 upgrade.
		Please check the <a href="../upgrading.html">upgrading</a> guide for more
		information.
		</p>
		</div>

		<p>In general, access restriction directives apply to all

docs/manual/upgrading.html.en

+56 −0

Original line number	Diff line number	Diff line
		@@ -138,6 +138,15 @@
		although for compatibility with old configurations, the new
		module <code class="module"><a href="./mod/mod_access_compat.html">mod_access_compat</a></code> is provided.</p>

		<div class="note"><h3>Mixing old and new directives</h3>
		<p>Mixing old directives like <code class="directive"><a href="./mod/mod_access_compat.html#order">Order</a></code>, <code class="directive"><a href="./mod/mod_access_compat.html#allow">Allow</a></code> or <code class="directive"><a href="./mod/mod_access_compat.html#deny">Deny</a></code> with new ones like
		<code class="directive"><a href="./mod/mod_authz_core.html#require">Require</a></code> is technically possible
		but discouraged. <code class="module"><a href="./mod/mod_access_compat.html">mod_access_compat</a></code> was created to support
		configurations containing only old directives to facilitate the 2.4 upgrade.
		Please check the examples below to get a better idea about issues that might arise.
		</p>
		</div>

		<p>Here are some examples of old and new ways to do the same
		access control.</p>

		@@ -165,6 +174,53 @@ Allow from example.org</pre>
		<div class="example"><h3>2.4 configuration:</h3><pre class="prettyprint lang-config">Require host example.org</pre>
		</div>

		<p>In the following example, mixing old and new directives leads to
		unexpected results.</p>

		<div class="example"><h3>Mixing old and new directives: NOT WORKING AS EXPECTED</h3><pre class="prettyprint lang-config">DocumentRoot "/var/www/html"

		<Directory "/">
		AllowOverride None
		Order deny,allow
		Deny from all
		</Directory>

		<Location "/server-status">
		SetHandler server-status
		Require 127.0.0.1
		</Location>

		access.log - GET /server-status 403 127.0.0.1
		error.log - AH01797: client denied by server configuration: /var/www/html/server-status</pre>
		</div>
		<p>Why httpd denies access to servers-status even if the configuration seems to allow it?
		Because <code class="module"><a href="./mod/mod_access_compat.html">mod_access_compat</a></code> directives take precedence
		over the <code class="module"><a href="./mod/mod_authz_host.html">mod_authz_host</a></code> one in this configuration
		<a href="sections.html#merging">merge</a> scenario.</p>

		<p>This example conversely works as expected:</p>

		<div class="example"><h3>Mixing old and new directives: WORKING AS EXPECTED</h3><pre class="prettyprint lang-config">DocumentRoot "/var/www/html"

		<Directory "/">
		AllowOverride None
		Require all denied
		</Directory>

		<Location "/server-status">
		SetHandler server-status
		Order deny,allow
		Deny from all
		Allow From 127.0.0.1
		</Location>

		access.log - GET /server-status 200 127.0.0.1</pre>
		</div>
		<p>So even if mixing configuration is still
		possible, please try to avoid it when upgrading: either keep old directives and then migrate
		to the new ones on a later stage or just migrate everything in bulk.
		</p>