How to restrict access to specific directories in Apache

Securing directories in Apache is vital for protecting sensitive files, scripts, and configuration details from unauthorized access. In many default Apache environments, directories are left open unless explicit restrictions are configured, which can result in unintended exposure of critical data. Employing directives such as Deny, Allow, and defining rules in .htaccess or httpd.conf prevents unwanted requests and fortifies overall server security.

Unauthenticated users pose a direct risk when they gain access to directories that store private or administrative assets. Directives including Directory blocks, along with the Require or older Order statements, allow administrators to tailor access permissions on a path-by-path basis. Establishing strict control over these locations minimizes the attack surface and reduces potential vulnerabilities.

Configuration files like .htaccess and httpd.conf specify how Apache handles incoming traffic, allowing granular regulation of subdirectories or entire file paths. Defining Deny rules or providing trusted addresses with Allow can help ensure that only legitimate processes interact with sensitive data. This approach keeps valuable resources protected while maintaining full functionality for permitted users.

Steps to disable access to directories in Apache:

Identify the directory you want to restrict by locating the appropriate Directory section in the configuration file.

$ sudo grep -nr "<Directory" /etc/{apache2,httpd}/
/etc/apache2/sites-available/default-ssl.conf:98: <Directory /usr/lib/cgi-bin>
/etc/apache2/sites-available/000-default.conf:20:        <Directory /home/user/website/>
/etc/apache2/apache2.conf:159:<Directory />
/etc/apache2/apache2.conf:165:<Directory /usr/share>
/etc/apache2/apache2.conf:170:<Directory /var/www/>
/etc/apache2/apache2.conf:176:#<Directory /srv/>
/etc/apache2/mods-available/alias.conf:15:<Directory "/usr/share/apache2/icons">
/etc/apache2/mods-available/userdir.conf:4:<Directory /home/*/public_html>
/etc/apache2/conf-available/localized-error-pages.conf:50:#     <Directory "/usr/share/apache2/error">
/etc/apache2/conf-available/serve-cgi-bin.conf:12:    <Directory "/usr/lib/cgi-bin">

Open the Apache configuration file with your preferred text editor.
```
$ sudo vi /etc/apache2/sites-available/000-default.conf
```
Related: Location for Apache configuration file

Insert a Deny directive inside the Directory block to block all access to the directory.

<Directory /home/user/website/>
        Require all granted
</Directory>
<Directory /home/user/website/forbid/>
        Order deny,allow
        Deny from all
</Directory>

Deny directive could be set to subdirectories of existing folder with allow permission.

Use the Allow directive if you want to permit access for specific IP addresses.
```
Allow from 192.168.1.100
```
This example allows access only from the IP address 192.168.1.100, replacing it with the desired IP or range.
Save the configuration file and exit the text editor.

Restart the Apache service to apply the changes.

$ sudo systemctl restart apache2 # For Ubuntu/Debian
$ sudo systemctl restart httpd # For CentOS/Red Hat

Verify that access to the directory is correctly restricted by navigating to it in a web browser or using a command-line tool like curl.

$ curl 127.0.0.1/forbid/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.55 (Ubuntu) Server at 127.0.0.1 Port 80</address>
</body></html>

If configured correctly, the server should respond with a 403 Forbidden status.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.

Discuss the article:

Comment anonymously. Login not required.