Take the 2-minute tour ×

I have the following two sections in my agache2.conf file.

<Directory />
    Options FollowSymLinks +Indexes
    AllowOverride None
    Order allow,deny
    Deny from all


<VirtualHost *:80>
DocumentRoot "/home/bernie/development/public2"
ServerName myfl2.local
  <Directory /home/aaaa/development/public2>
    AllowOverride None
    #Options FollowSymLinks +Indexes
    Order allow,deny
    Allow from all

The following file exists with some content:


For some reason, trying to access


I get a "403 Forbidden" error. I've narrowed the problem down to the line "Deny from all" in the first directory section above, but I can't figure out how to keep that (as it's a very important directive) and allow access to public2/a/a directory. Anyone have any idea how to fix that?

share|improve this question
add comment

2 Answers

You have two options that I can think of. One is to create a separate directory directive. The other is to do the following:

Above the directory directive:

SetEnvIf Request_URI "/public2/a/a/*" publicaccess

Within the directory directive:

Allow from env=publicaccess

Although, I'm curious: what's the point of a directory that's only Deny all?

share|improve this answer
I've seen a lot of sites where <Directory /> is Deny from all and then specific directories are overridden to allow access -- Not sure how much extra security it buys, but it's an option :) –  voretaq7 Mar 17 '11 at 16:02
I could see that. I'm not saying it's wrong, just that I was curious about the reasoning :-) –  Hyppy Mar 17 '11 at 16:23
add comment

The Order setting is the key here. The /home/aaaa/development/public2 directory has both an Allow from all and Deny from all directive associated, and the Order is set to allow,deny. This means that a deny command is always going to take precedence over an allow command.

Changing the Order directive in the more specific block should solve the problem. Another option would be to take out the explicit Deny from all in the block for /; when the order is allow,deny then no request will be allowed without an explicit Allow.

share|improve this answer
add comment

Your Answer


