How to use Require directive to limit file access in apache 2.4

Question

I have a directory structure like the following for a website on Ubuntu 14.04, running apache 2.4.7:

/websites/mywebsite/index.htm
/websites/mywebsite/private.htm
/websites/myqwbsite/folder/privatefile.ext
/websites/mywebsite/folder/subfolder/publicfile.ext

In the Apache config for the site, I have

<Directory /websites/mywebsite/>
   AllowOverride Limit
   Require all granted
</Directory>

I want to use .htaccess files in the site folder such that the private.htm and privatefile.ext files are Require all denied but everything else is granted.

I tried the following two .htaccess files:

/websites/mywebsite/.htaccess:

<FilesMatch (private.*.htm)$>
   Require all denied
</FilesMatch>

/websites/mywebsite/folder/.htaccess:

Require all denied

/websites/mywebsite/folder/subfolder/.htaccess:

Require all granted

However, apache gives a 500 - "Require not allowed here" for /websites/mywebsite/.htaccess

How can I make what I want happen with apache 2.4-compatible configuration (ie I do not want to load mod_access_compat and use the old style config)?

Answer 1

In the apache config for the site, you have to extend AllowOverride properties. Add: FileInfo and AuthConfig. Or set "AllowOverride All"

I had same problem, fixed with this config :

<Directory /websites/mywebsite/>
   Options +FollowSymLinks +SymLinksIfOwnerMatch
   AllowOverride FileInfo AuthConfig
</Directory>