Ispcp Omega Error 403 /server-status Forbidden

[JorgeMario]

Hello ISPCP Omega,

I am student and I am working in implementation of security tips in Apache Webserver. Now, I must know, how many users are connected simultaneously in Webserver and I am using “server-status” tool of Apache. Is easy to modify “apache2.conf” file, with following lines:

<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from localhost aa.bb.cc.dd (IP address of remote Computer)
</Location>


After, restart the Webserver and load the page http://localhost/server-status

But I cannot load the webpage, I have some error messages:


In Firefox the message is: ispCPOmega Error 403, /server-status Forbidden !!!


I have installed a Virtual Machine with Debian Server in my Laptop like test environment and all works good. But in the real Webserver, server-status does not work !!!

I have looked for possible reasons like security restrictions in other configuration files like ispcp.conf, but I have not found solution !!!

Maybe you can help me,

Best regards,

Mario

[joximu]

This is not an ispcp problem.

http://localhost/server-status

this works, if the browser is on the same machine as the server - otherwise you may try
http://[ip-of-server]/server-status

/J

[JorgeMario]

joximu, Thank you for your reply,

I have written the ip address "aa.bb.cc.dd" in apache2.conf file like:

<Location /server-status>
SetHandler server-status
Order Deny,Allow
Deny from all
Allow from localhost aa.bb.cc.dd (IP address of remote Computer)
</Location>

Now in web browser of remote Computer, I write:
http://[ip-of-server]/server-status,

but does not work. I have the error message. And there is connection between webServer and Remote Computer (I have tested with ping command)

In command line of web server I try with the command: $ lynx http://localhost/server-status,
but does not work. I have the same error message !!!!!

Thanks for your help,

Jorge Mario

[joximu]

Hi Jorge

I have this snipplet in my 00_master.conf - inside the virtualhost part...

# Master Begin
#
<VirtualHost <server-ip>:80>
...
...
<Location /server-status>
SetHandler server-status
Order deny,allow
Deny from all
Allow from localhost ::1
Allow from aa.bb.cc.dd
</Location>
...
</VirtualHost>
#
# Master End
#

where aa.bb.cc.dd is my IP at home...
and this works (http://server.host.name.tld/server-status/)

Be sure to have enabled the status module.

If still error: check the apache logs!

/Joxi

[JorgeMario]

Hi Joxi,

I have included the code in "00_master.conf" file and restarted the webserver, but does not work. I have the same error message

The status module is enabled: I have "status.conf" file and "status.load" file in the /etc/apache2/mods-available/ directory

In apache logs, I have the following message:

....... client denied by server configuration: /var/www/server-status

Thank you for your help,

Jorge Mario

[joximu]

/var/www/server-status

this is wrong:
apache tries to read from a real folder /var/www/server-status (where /var/www obviously is the default web.root). So there is somehing wrong.


["status.conf" file and "status.load" file in the /etc/apache2/mods-available/ directory]
-> and you also have symlinks to theese two files in /etc/apache2/mods-enabled?

otherwise try "a2enmod status" and restart apache.

/Joxi