I have a problem where people can't view the 403 error document(that is also denied access to). Yet people on my allow list CAN view it when navigating to the root directory (which I want blocked).

So 172.25.0.150 >> http://172.25.0.165/website = success
So 172.25.0.150 >> http://172.25.0.165/ = 403 document page (success)
So 172.25.1.15 >> http://172.25.0.165/website = Denied, but no 403 page
So 172.25.1.15 >> http://172.25.0.165/ = Denied, but no 403 error page(my one)

Any help would be appreciated

<VirtualHost *:80>

ServerAdmin blahblah@blah.net
ServerName 172.25.0.165
DocumentRoot /var/www/
ServerSignature Off
HostNameLookups Off
ErrorLog /var/www/logs/error.log
<Directory />
Options None
AllowOverride None
Deny from All
</Directory>
<Directory /var/www/website>
Options Indexes FollowSymLinks MultiViews IncludesNoExec
Order deny,allow
Deny from all
Allow from 172.25.0.219
Allow from 172.25.0.218
Allow from 172.25.0.157
Allow from 172.25.0.150
Allow from 172.25.0.130
Allow from 172.25.0.165

</Directory>
<Directory /var/www/error/>
Allow from all
</Directory>
#Set Directory Index
<IfModule dir_module>
DirectoryIndex index.html index.php index.php4 index.cgi index.pl
</ifmodule>
#Error documents here
ErrorDocument 403 /error/403.html
</VirtualHost>

"allow from" is answer
You can add another line
Allow from 172.25.1.x
x replace with your client ip. You can even allow whole network range

Ah I was hoping that wasn't the case :s
So my deny from "everything else" has blocked access to the 403 error document that I've created?

I guess I'd have to append another module to say that:

"If incoming address is not on allow list, show 403 error document (403.html)" ?


Thanks for the input

Ok: Update.

The computer that I'm testing from (has an ipaddress not on the allow list) can view the 403 error document when I type in the direct path:

172.25.0.165/error/403.html

But it cannot view the 403 error document if I navigate to the root directory(which is blocked), (Or any other blocked directory for that matter)
If a client on the allow list navigates to the root directory, it gets the correct error page :s

Hi

Your configuration is correct, so it should work. Take a look at error_log to see if you find anything.
In the meantime you can use:
Regards

1 members found this post helpful.

[Thu Dec 22 07:24:03 2011] [error] [client 172.25.1.1] client denied by server configuration: /var/www/
[Thu Dec 22 07:24:08 2011] [error] [client 172.25.1.1] client denied by server configuration: /var/www/website
[Thu Dec 22 07:25:02 2011] [error] [client 172.25.1.1] Directory index forbidden by Options directive: /var/www/error/
[Thu Dec 22 07:25:14 2011] [error] [client 172.25.1.1] client denied by server configuration: /var/www/website/wp-admin

It seems to be denied by the configuration file. However I'm still not seeing why. My error document is allowed, so it should be re-directed :s

I'll give the http direct link method a go and see how that works

Ok, the direct HTTP method works. However it's only an interm solution as I don't really want the link to be displayed like that.

I shouldn't have to use .htaccess files surely? having only two directories should mean the main config file should be sufficient?

Huh. Between the first 2 logs (access to forbidden pages) and the 3rd (access to /error, meaning apache tried to give the 403 error document), there is a 1 min. gap. How comes?
Are you by any chance using mod_rewrite or something? As I see you're using wordpress, that comes with some mod_rewrite rules, so it's worth looking into them if you're not using your own.
Regarding the "Directory index forbidden by Options directive: /var/www/error/", add an index.html so apache stops complaining


As I told you you can use it while trying to solve your problem. And since it works as expected, it makes me think that it is mod_rewrite that is responsible for this behavior

1 members found this post helpful.

Ah, I was busy between to RDP sessions, so I had a minute between retry attempts on the test VM.

Add an index? So I would add the ifmodule for the <Directory /var/www/error> group?

As for wordpress, I'm not adding any .htaccess files or other virtualhosts for it. It worked fine with the default Apache2 config file too, however I made this one so I could restrict access to other directories.

The mod_rewrite does make sense... any idea where I should be looking to find it?

No, what I'm trying to tell you, is that you should get a 403 error 2 times at the same moment. One for the /website and the other for the /error/403.html (the latter shouldn't happen and it's the problem you're facing, if I understand well your 1st post). You don't get the 2nd error, so apache looks that it works as expected, and gives you the 403 error page!!!
I've tried to do the same setup here (using different docroot), so you should get the following if there was a problem with /error:
No, add an index.html page in /error (even blank)


It should be in a .htaccess in the root directory of wordpress. I guess this is the /website in your case

Regards

Thank you for that

I haven't found an htaccess file in the root directory of wordpress, I've searched and even used "ls" in case it was hidden in the GUI search.

I've uploaded 3 pictures. One is from ".150" which is allowed to access the wordpress directory(chrome images), the other two are from my test VM which isn't on the allow list (therefore denied). Both computers can get to the error document when typing the direct path, however when I change the path to "/error/403.html" in the virtual host file, only the computer on the allow list will be given the error document when navigating to http://172.25.0.165 (which is blocked as per the config file in post #1).

The permission error shouldn't happen for the error/403.html file as I allowed "all" to that directory(/var/www/error). Which is correct, as giving the 403 error document a path of "http://172.25.0.165/error/403.html" works. However giving /error/403.html as the path for the "error document" doesn't work for addresses not listed as allowed in the virtual host file.

I know it has to be a permission problem, I'm just struggling to find out where that issue is.

Attached Thumbnails

     

Hi,

Mind that it's .htaccess (with a dot in the beginning), meaning the file is hidden from ls. Try "ls -la", because AFAIK wordpress uses .htaccess to rewrite URLs.


I've already told you, that it's correct. Besides I've simulate your setup here and it worked as expected (see my previous post).
That's why I think it's a .htaccess involved. Unless you're using a proxy (unlikely) to access your server and you get cached responses from it.