Found it! As usual, right under my eyes!<div>I've mixed the order between Deny and Allow!</div><div><br><div><div><Location /rhn/></div><div> Order Deny,Allow</div><div> Allow from 192.168</div><div>
Allow from 127.0.0.1</div><div> Allow from 10.120.2.5</div><div> Deny from all</div><div></Location></div><div><br></div><div><Location /help/></div><div> Order Deny,Allow</div><div>
Allow from 192.168</div><div> Allow from 127.0.0.1</div><div> Allow from 10.120.2.5</div><div> Deny from all</div><div></Location></div><div><br><div class="gmail_quote">2011/8/26 Pierre Casenove <span dir="ltr"><<a href="mailto:pcasenove@gmail.com">pcasenove@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Hello,<div>i've been trying a bit more around this.</div><div>What I did:</div><div>In file /etc/httpd/conf.d/zz-spacewalk-www.conf, I've added the following:</div>
<div><div><Location /rhn></div><div> Order Allow,Deny</div>
<div> Allow from 192.168.1.1</div><div> Allow from 127.0.0.1</div><div> Allow from 10.120.2.5</div><div> Deny from all</div><div></Location></div><div><br></div><div>I'm getting an error :</div>
<div>[Fri Aug 26 14:45:36 2011] [error] [client 192.168.1.1] client denied by server configuration: proxy:ajp://localhost:8009/rhn/Login.do</div><div><br></div><div>Which really confuses me. I've been working around this a lot but can't get something to work.</div>
<div><br></div><div>I've modified Location tag by Proxy tag... everybody gets access!</div><div><br></div><div>If someone has an idea, please share!</div><div><br></div><font color="#888888"><div><br></div><div>Pierre</div>
</font><div><div></div><div class="h5"><div><br></div><div>
<br></div><br><div class="gmail_quote">2011/8/24 Pierre Casenove <span dir="ltr"><<a href="mailto:pcasenove@gmail.com" target="_blank">pcasenove@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>Hello,</div>iptables can't do the trick, as spacewalk clients connect to port 443 as well as the admins<div>I've tried to add a Location /rhn tag with allow/Deny rules, but I get a spacewalk error 403 page when I reload apache.</div>
<div>I haven't dig too much around this point, I'll keep informed if I get something working.</div><div><br></div><font color="#888888"><div>Pierre</div></font><div><div></div><div><div><br><br><div class="gmail_quote">
2011/8/24 Matt Moldvan <span dir="ltr"><<a href="mailto:mmoldvan@dcctools.com" target="_blank">mmoldvan@dcctools.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If all else fails a simple IPTables rule could do this also, or even complement the Allow From rules.<br>
<br>
Regards,<br>
Matt.<br>
________________________________________<br>
From: <a href="mailto:spacewalk-list-bounces@redhat.com" target="_blank">spacewalk-list-bounces@redhat.com</a> [<a href="mailto:spacewalk-list-bounces@redhat.com" target="_blank">spacewalk-list-bounces@redhat.com</a>] on behalf of Michael Mraka [<a href="mailto:michael.mraka@redhat.com" target="_blank">michael.mraka@redhat.com</a>]<br>
Sent: Tuesday, August 23, 2011 8:42 AM<br>
To: <a href="mailto:spacewalk-list@redhat.com" target="_blank">spacewalk-list@redhat.com</a><br>
Subject: Re: [Spacewalk-list] Filtering webui access<br>
<div><div></div><div><br>
Pierre Casenove wrote:<br>
% Hello,<br>
% My security department ask me to filter the HTTPS access to the webui based<br>
% on the IPs of the administrator.<br>
% The administrators are on a predefined subnet, but the spacewalk clients are<br>
% on multiple subnets.<br>
% Is it possible to filter https access (either in apache or iptables) without<br>
% breaking YUM https communication between spacewalk server and clients?<br>
<br>
WebUI is available under <a href="https://spacewalk/rhn/" target="_blank">https://spacewalk/rhn/</a> and<br>
<a href="https://spacewalk/network/" target="_blank">https://spacewalk/network/</a>, while clients (rhn_register, yum, etc.) go<br>
primarily to <a href="https://spacewalk/XMLRPC/" target="_blank">https://spacewalk/XMLRPC/</a>.<br>
<br>
There is also some more interfaces for package push, ISS, etc. list of<br>
which you can find in<br>
/etc/rhn/satellite-httpd/conf/rhn/spacewalk-backend-*.conf (on RHEL5)<br>
or in /etc/httpd/conf.d/zz-spacewalk-server-wsgi.conf (on RHEL6 and<br>
Fedoras).<br>
<br>
So you might be able to limit access in httpd via<br>
<br>
<Location ...><br>
Order allow,deny<br>
Allow from ...<br>
Deny from ...<br>
</Location><br>
<br>
I've never heard about anyone doing this so it'll be great if you<br>
share your experience with others.<br>
<br>
Regards,<br>
<br>
--<br>
Michael Mráka<br>
Satellite Engineering, Red Hat<br>
<br>
_______________________________________________<br>
Spacewalk-list mailing list<br>
<a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br>
<br>
_______________________________________________<br>
Spacewalk-list mailing list<br>
<a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>