Protect apache2 server-status handler by password
In my apache2 server I access /server-status
to check my current status of the web-server. I found that mods-available/status.conf contains the snippets that is responsible for showing status.
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from localhost ip6-localhost
</Location>
My question is how can i make it available not only for localhost but also for remote host with authentication?
To allow other hosts, you can just update line:
Allow from localhost ip6-localhost
to read:
Allow from localhost ip6-localhost 1.2.3.4 1.2.3
For the authentication part, you add a block like:
AuthType Basic
AuthName "Restricted Files"
# (Following line optional)
AuthBasicProvider file
AuthUserFile /usr/local/apache/passwd/passwords
Require user rbowen
The passwords
file need to be created using htpasswd
utility. Have a look at this page for more details.
In the <Location /server-status>
stanza, include both the Allow from localhost
and authentication directives. The key is to use Satisfy Any
to specify that requests from localhost can bypass authentication.
Edit: Explicit example, as requested (it just combines everything that everyone has said so far):
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Satisfy Any
Allow from localhost ip6-localhost
AuthType basic
AuthName "Apache status"
AuthUserFile /etc/apache2/passwd-server-status
Require valid-user
</Location>
You can use something similar:
<Location /server-status>
SetHandler server-status
AuthType basic
AuthName "Apache status"
AuthUserFile /etc/apache2/passwd-server-status
Require valid-user
</Location>
Also, don't forget to create the password file and account for yourself with the following command (replace username with whatever username you prefer):
htpasswd -c /etc/apache2/passwd-server-status username