I'm not sure if I'm missing anything here, but is it intended that
webapps should not be accessible from anywhere but localhost by default?
This seems to be the case for at least wordpress - which is my kind of
'gold standard' for webapp packaging on Fedora, I use it as a reference
- and roundcubemail. They both have this block in
their /etc/httpd/conf.d/name.conf file:
<Directory /usr/share/name>
AllowOverride Options
<IfModule mod_authz_core.c>
# Apache 2.4
Require local
</IfModule>
<IfModule !mod_authz_core.c>
# Apache 2.2
Order Deny,Allow
Deny from All
Allow from 127.0.0.1
Allow from ::1
</IfModule>
</Directory>
Which pretty clearly disallows access from anywhere but localhost. It
seems an odd default configuration, in that if you ever want to allow
anyone to actually access your webapp you're going to have to change it,
which will prevent it ever being automatically updated again (you'll
always get a .rpmnew file). I have to change the 'Require local' to
'Require all granted' and restart httpd in order to actually let
anything but localhost access the site.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | identi.ca: adamwfedora
http://www.happyassassin.net
--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
