Skip to end of metadataGo to start of metadata

This error means that the access to the directory on the file system was denied by an Apache configuration.

• Apache can act as a proxy for either FTP or HTTP services, and it’s possible to add other proxy types using extensions. Whatever protocol is used, the result of using the proxy service is that communication requires extra steps. For example, interaction between Client and ServerWatch.com instead of being: Client sends request to ServerWatch.com.
• In CXF 2.7.x no JAX-RS 2.0 Client API is supported and CXF specific Client API is located in the cxf-rt-frontend-jaxrs module. CXF Apache HttpClient based transport is required to get the asynchronous invocations working correctly.

Jan 04, 2008 A reverse proxy is used to redirect requests for a Web site to a number of servers for a client. SWatch Reader Favorite! A forward proxy server provides Internet access for any number of clients via a single server. Learn how to configure your Apache server to accomplish these tasks and reap the benefits. Modproxy, the main proxy module Apache module for redirecting connections; it allows Apache to act as a gateway to the underlying application servers. Modproxyhttp, which adds support for proxying HTTP connections. Modproxybalancer and modlbmethodbyrequests, which add load balancing features for multiple backend servers.

Apache HTTP server 2.4 notes

The 2.4 release introduced significant changes to the authorization and authentication process. Users of that release are encouraged to read this link to migrate their older config files.

Before you start

Before attempting to alter any existing config file, please take note of the full file system path for which access is being denied, and the IP or hostname of the client:

Using the correct path in the directory block for the following examples is essential to solving this problem. In this case, a client from the local machine (::1) is being denied access to /var/www/example.com .

Troubleshooting

First, remember 'Directory' permissions propagate to subdirectories by default.

The possible causes are:

• Access was denied due to an explicit deny (2.2) directive or require (2.4) directive in a directory block or .htaccess file.
  

2.2:

2.4:

In the above examples, using the following configuration will resolve the issue:

2.2:

2.4:

• An attempt to access a directory outside of the DocumentRoot defined by an alias without a corresponding directory block.
  

Solution (2.2):

Solution (2.4):

• Proxying to a service with no explicit access in a location block.
  

Solution (2.2):

Microsoft word 2010 free download for mac full version. Solution (2.4):

• A PUT request was received; a 403 is the default response. Access can be granted with limitexcept (2.2) or mod_allowmethods (2.4).
• A mix of allow (2.2) and require (2.4) directives while using apache HTTPD 2.4, used in the same or separate directory blocks. The new 2.4 directives should be used exclusively, and the mod_access_compat module should be unloaded by commenting out the LoadModule directive.
  

The solution:

• Using mod_security with an explicit directive to deny access. Altering or commenting out the offending directives from that module will resolve the issue.
• Using a bandwidth or rate limiting module such as mod_evasive, mod_limitipconn or mod_bw. A capable firewall is far more efficient at limiting traffic bursts, and abusive clients.
  

Words of caution

The following configuration may be included in your apache HTTPD configuration; its purpose is to prevent unauthorized access to the root of the file system. Under no condition should it be altered. Instead, the existing directory block for the full file system path should be altered, or a new one should be created if it was not already present.

2.2:

2.4:

Restricting access a little further

If granting full access to the resource in question is not an option, specific IP addresses, partial IP addresses, network masks and CIDR specifications can be used with the allow and require directives.

With 2.4.x you can use UrBackup with a HTTPS proxy. This way you can have the web interface and the clients connecting at the same port, secured by the same transport encryption (SSL). This post shows how to do this in combination with the Apache web server.

Apache As Proxy Server

The idea is that the client connects to the web server and issues a HTTP CONNECT request to the actual UrBackup server.

First Enable CONNECT proxy module in apache. On debian via

Then allow connections to the UrBackup server Internet port by adding

to your apache configuration.
Next in your apache virtual host configuration, set proxy options such as the timeout, allow proxy connections to the UrBackup server, and disallow them to every other host:

Then, go to your UrBackup server web interface and setup your web server URL as Internet client proxy (https://example.com) and the Internet server name/IP as 127.0.0.1. Internet clients should then start connecting via your web server to your UrBackup server. Once all clients connect this way you could turn off UrBackup’s build in Internet transfer encryption and rely on SSL.

Fixing client IP addresses

Apache Http Client Proxy Server

You may notice that on the status page all Internet clients now show the IP address of your web server as their IP address. Fixing this is a bit difficult, as there is no standard way to forward the client IP address information from the web server (compared to a normal HTTP proxy where there is a X-Forwarded-For header). So, a bit of hacking to fix this is in order. I modified the mod_proxy_connect apache plugin to forward the client IP information in a 50 byte buffer to the backend: mod_proxy_connect.c
On debian you could replace your original mod_proxy_connect with the modified one via the following commands:

Apache Httpclient Proxy Https

Then in the UrBackup server advanced global settings set “List of server IPs (proxys) from which to expect endpoint information (forwarded for) when connecting to Internet service (needs server restart)” to include your web server IP (127.0.0.1 in the example here). After a server restart you should be able to see the actual client IP instead of the web server IP on the status screen.

Fixing SNI errors

If you have multiple virtual hosts with SSL there is an issue with SNI. Apache2 automatically compares the hostname in the CONNECT request with the server name in the SSL connection (SNI) and rejects the request if they differ. The only solution (or ugly hack) I found to fix this was to add the hostname with the target IP to /etc/hosts and then use the hostname instead of the IP in the CONNECT request. I.e., add “127.0.0.1 example.com” to /etc/hosts, then replace 127.0.0.1 with example.com in all the configuration above.

Additional proxy authentication

As additional security layer, one can require proxy authentication. Clients need to know a username+password to get through the web server to the UrBackup server. With apache2 e.g.:

Then modify the proxy section to:

Afterward add username+password to the proxy url, that is e.g. https://urbackup:password@example.com