mod_jk and Apache Directory directives

[sedell]

I've run into a configuration problem with Apache using mod_jk to connect to tomcat. I have Apache set up running virtual hosts forwarding the requests to Tomcat. On one of the virtual hosts, I want to block an IP address, but can't get it to work. Here's the relevant config:

<VirtualHost *:80>
ServerName

http://www.domain.com

ServerAlias beta.domain.com, domain.com, 192.168.1.16
DocumentRoot D:/Apache/Apache2/htdocs/

http://www.domain.com

ErrorLog logs/

http://www.domain.com.error.log

LogLevel warn
CustomLog logs/

http://www.domain.com.access.log

combined

<Directory />
Order Deny,Allow
Deny from 192.168.1.50
Allow from all

Options FollowSymLinks
AllowOverride none
</Directory>
<Directory "/dbadmin/">
Options FollowSymLinks
AllowOverride AuthConfig
</Directory>
JkMount /* ajp13
JkUnMount /dbadmin* ajp13
</VirtualHost>

I can't get the deny from 192.168.1.50 to work. I suspect it has to do with mod_jk and the JKMount /* directive, but I'm not certain. Do the Apache directives not work, instead letting Tomcat handle it due to the way it's mounted?

 

[Wishdiak]

sedell,

Two things come to mind here.

1. Are you trying to block all access from a specific IP? If so, you should probably move the <Directory> container out of the VirtualHost into your main httpd.conf.

If not, you should specify in the <Directory> container the specific directory that you want to deny access to.

2. The general best practice for the Order directive is to apply the most general permission first, and the exceptions afterwards. In your case, this would translate to

Order Deny,Allow
Allow from all
Deny from 192.168.1.50

http://httpd.apache.org/docs/mod/mod_access.html#order

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[sedell]

Thanks for the reply.

I tried specifying this in the default Directory container - that didn't work. I also tried the Directory container for the document root, and that didn't work either.

I'm wondering if the Directory directives even work with the requests being passed off to Tomcat.