Red Hat Bugzilla – Bug 11829
Alias problem in Apache httpd.conf
Last modified: 2008-05-01 11:37:55 EDT
Problem known to exist on: apache-1.3.13-2 (may affect earlier versions/unkown) Description. Unable to access /usr/doc aliased out to /doc under httpd.conf. Temporary solution: re-activate access.conf and put aliases in there. I have tested this on my own machine and found this to be a valid bug. However file:/usr/doc is still functional. This was first brought to my attention in the redhat-install-list mailling list. Since I had an access.conf it didnt appear as a problem until I removed access.conf and used the entries in httpd.conf and it failed. Additional mention was seen on comp.infosystems.www.unix
Bleh no no! If the alias to doc is enabled it allows remote users to know the versions of packages you have installed on the system and thus lessens your security by telling hackers the versions of programs which could potentially be vulnerable to some sort of attack. By default /usr/doc is only accessable from localhost which is not denied access. For example, from your linux machine try: lynx http://localhost/doc/ and you'll recieve the contents of your /usr/doc directory. Do this remotely and you are denied access. Maybe you are pointing out a different problem, if so sorry for wasting your time, just in case the permissions were unclear to you. -Stan Bubrouski
Stan is correct. By default, the /doc alias can only be accessed from the local host. If you absolutely need to, and aren't concerned with any of the security implications, change this section: <Location /doc> order deny,allow deny from all allow from localhost Options Indexes FollowSymLinks </Location> to: <Location /doc> order deny,allow allow from all Options Indexes FollowSymLinks </Location>
1.) I think I will just leave it at allow from 192.168.1. 2.) Since I use BindAddress 192.168.1.1 allow from all would not have been an issue either. 3.) The other issue was resolved by talking to the people complaining and finding out that they were mis-typing the URL. PBKAC. The difference is when you add any ip restrictions and dont include localhost, one or the other would work but not both. I never noticed the problem because I had entries for 192.168.1. in access.conf and localhost in httpd.conf. So it really wasnt an issue for me.
I noticed the same behavior, but when I checked my access_log, it said I was coming from localhost.localdomain, not just localhost. When I changed the reference in httpd.conf to say localhost.localdomain it worked fine.