I've spent a couple hours tracking down the cause unexpected and (I believe)
spurious log messages.
If I'm right that the messages ARE spurious, I'll file a bug report. But before
I do that, can anyone see something I'm doing wrong?
Here is the relevant section of my httpd configuration file....
<VirtualHost *:80>
ServerName internal.mydomain
DocumentRoot /var/www/internal/html
<Directory "/var/www/internal/html">
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
ScriptAlias /cgi-bin/ /var/www/internal/cgi-bin/
<Directory "/var/www/internal/cgi-bin">
AuthType Basic
AuthName "Internal"
Options FollowSymLinks
AuthUserFile /var/www/internal/access/htpasswd
AuthGroupFile /var/www/internal/access/htgroups
Require group internaluser
</Directory>
This mostly does what I would expect: attempts to access
http://internal.mydomain/cgi-bin/foo
are met with a password prompt. And if the right password is
given, the scrips
/var/www/internal/cgi-bin/foo
is invoked.
The same thing happens for
http://internal.mydomain/cgi-bin/foo/arguments-here
Everything works, and no errors are logged.
EXCEPT when access to the document root is protected by a ".htaccess"
file that refers to a AuthUserFile that requires different passwords.
When that is the case, everything still works BUT the error log for
the virtual hosts gets a line of the form...
user someuser: authentication failure for "/arguments-here":
Password Mismatch
The error line only appears when the requested URL extends beyond the
script name (i.e. when there are "arguments-here"). The script is
invoked as it should be, and sees "arguments-here", but IN ADDITION to
the intended processing, something attempts to authenticate access to
"arguments-here" in the document tree. Nothing appears in the access
log (apart from the successful access to the script), only the error log.
If the password for the cgi-bin directory works for the document tree,
no error is logged. Which suggests that the spurious/unintended
access may be succeeding...
Have I misunderstood something? Am I doing something wrong?
Or is there a bug?
Robert.
--
Robert Inder, 0131 229 1052 / 07808 492 213
Interactive Information Ltd, 3, Lauriston Gardens, Edinburgh EH3 9HH
Registered in Scotland, Company no. SC 150689
Interactions speak louder than words
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
