Member Avatar for gentlemedia

I have to do this: "the .htaccess file should allow the following directives"

DirectoryIndex Deny Allow Options Order
AddHandler RewriteEngine RewriteBase RewriteCond RewriteRule

But I have no clue where to start with this. If I read about the first one for example https://httpd.apache.org/docs/2.4/mod/mod_dir.html then the default value is DirectoryIndex index.htmlwhich I understand that it's looking first for an index.html file in the web root unless you tell otherwise, but what does this say about allow or not?

Another one the RewriteEngine I have already the line RewriteEbgine On in my htaccess file, but again what does this say about allow or not?

I pretty much checked the Apache docs for all of them listed here, but I'm still in the dark here. Who can shed some light on this for me? :)

Edited by gentlemedia because: Typo', typo, typo/s
  • 2 Contributors
  • 12 Replies
  • 716 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by gentlemedia

Dani AI

Generated

Short version: "Allow" means "which override classes Apache will accept inside .htaccess", and that's controlled in the main server config (the <Directory> that covers your site) by AllowOverride or by the finer-grained AllowOverrideList. .htaccess itself cannot grant new permissions — the server must allow them first. (httpd.apache.org)

Concrete mapping (what token you need to permit in Apache config so those directives work in .htaccess):

  • DirectoryIndex → Indexes
  • Deny / Allow / Order → Limit (legacy access directives; provided via the access_compat module)
  • Options → Options
  • AddHandler → FileInfo
  • RewriteEngine / RewriteBase / RewriteCond / RewriteRule → FileInfo
    This mapping comes from Apache's override-class index (it lists which directives belong to Indexes, FileInfo, Limit, etc.). (httpd.apache.org)

What to do next (high level): enable the matching override classes in the Directory block that controls your document root (do this in the server config / WHM include — not inside .htaccess). For example, allow the Indexes, FileInfo, Limit and Options classes rather than using All if you prefer a narrower grant. If you want even tighter control, use AllowOverrideList to whitelist specific directive names. After changing config, reload Apache and test. (httpd.apache.org)

Troubleshooting notes: a 500 error from a new .htaccess line usually shows a clear message in Apache's error_log (messages like "Invalid command 'X', perhaps misspelled or defined by a module not included" or "X not allowed here"). Check the log first. Also remember some directives require the module to be loaded (mod_rewrite for rewrite rules, mod_mime for AddHandler, mod_access_compat if you keep Deny/Allow/Order). In Apache 2.4 the recommended access control is the newer Require-style directives, though access_compat still supports the old syntax. (support.cpanel.net)

Notes tied to the thread: was correct to point you at changing the Directory config rather than putting that configuration into .htaccess, and was right to use WHM/EA4 to edit the Apache config instead of trying to put server-only directives inside .htaccess.

Recommended Answers

All 12 Replies

Member Avatar for gentlemedia

Thanks, AndrisP!

I have Apache 2.4 running and mod_auth_host for that version it seems to be require.
http://httpd.apache.org/docs/current/mod/mod_authz_host.html

But still I just don't get it. For example, how do I allow the DirectoryIndex directive?
https://httpd.apache.org/docs/2.4/mod/mod_dir.html
I don't see any mention about allow on that page/section.

I found about turning on directory indexes to allow access
Options +Indexes
But I don't know if this is what they mean.

Edited by gentlemedia
Member Avatar for AndrisP

You can set directive in to the file /etc/apache2/sites-available/000-default.conf e.g.

    <Directory /path/to/your/localhost/public_html/>
        Options FollowSymLinks MultiViews Includes Indexes
        AllowOverride All
        Require all granted
    </Directory>

(reload apache)
if missing file index.php (or other filename who is set on the DirectoryIndex directive) then open in browser http://localhost/ or http://localhost/non_exists_filename.php shows directory listing. Remove Indexes to be safe (reload apache).

Member Avatar for gentlemedia

Thanks!
If I place that block in my htaccess file in public_html, instead of the apache config file, I can just use it like so?

<Directory "/">
    Options FollowSymLinks MultiViews Includes Indexes
    AllowOverride All
    Require all granted
</Directory>

EDIT: No, that's not right. I get a 500 Internal Server Error :)

EDIT2: It's because I can't use Directory directive in a htaccess file

Edited by gentlemedia
Member Avatar for AndrisP

By default .htaccess is disabled. To use it set directive AllowOverride All

Member Avatar for gentlemedia

I have now this in my .htaccess file

Options FollowSymLinks MultiViews Includes Indexes
# AllowOverride All
Require all granted

But I had to comment out AllowOverride All, because with it I got that '500 Internal Server Error' again

Member Avatar for AndrisP

Directive AllowOverride All need set to default config file

Member Avatar for gentlemedia

Directive AllowOverride All need set to default config file

Ao ok! So I have WHM/cPanel on the VPS and If I go to Apache Configuration > Global Configuration I see an option Optimize .htaccess (AllowOverride) which is set to it's default search_full_path but my guess is that you don't mean that.

EDIT:
Also if I read the docs to modify httpd.conf directly they don't recommend it.
https://documentation.cpanel.net/display/EA/Advanced+Apache+Configuration#AdvancedApacheConfiguration-Modifythehttpd.conffiledirectly

EDIT2:
I read futher on that I can test if WHM/cPanel override my modifications to httpd.config, so I try to open the config file as su root with the following command
/usr/local/apache/conf/httpd.conf
but I can't access it even as root
permission denied

Edited by gentlemedia
Member Avatar for gentlemedia

If I check the file permissions on httpd.config with
ls -laZ /usr/local/apache/conf/httpd.conf
I get the following output
permission_httpd_config.jpg

As far as I can see I do have read/write permissions ot not?

Edited by gentlemedia
Member Avatar for gentlemedia

It's obvious that I'm getting really lost with this :)
This .htaccess is the last bit that I have to do regarding the system requirements of CS-Cart
http://docs.cs-cart.com/4.6.x/install/system_requirements.html

As a server noob I got this far, but it takes me forever to get it done, so if anyone is interested in a little job to get this htaccess right, just PM me! I just wanna start installing the bloody CS-Cart :)

Member Avatar for gentlemedia

I see there are no takers for my job application :-) so I took some roundtrips to the CentOS and cPanel forums and figured out that I had an old documentation (EasyApache 3) but I have EasyApache 4 installed in WHM . CentOS said there's no support from them anymore, because of the fact that WHM/cPanel is installed on it.

Anyway... with the new documentation I found out that modifying httpd.conf is way more easier then that was with EasyApache 3. It can be done now within the WHM GUI.

Thus... I added the <Directory> block to my httpd config file, so that one is set.

@AdriesP - You said that by default .htaccess is disabled and with this addition it's now not, so what is my next step to figure out how to allow these directives in .htaccess?

Edited by gentlemedia
Member Avatar for gentlemedia

I guess that was just all to it. I installed CS-Cart and so far so good. No weird warnings yet! Finger crossed!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.