Access: Order Allow, Deny or Deny, Allow ???

Configured CUPS, in the process there was a misunderstanding with the Order directive, which sets the reading order from the Allow and Deny directives. On apache.ru there is information about this, but not complete and with a typo / error. I translated the article from httpd.apache.org + projected the material on the local area network. Perhaps it is useful to someone thread.

So, the Order directive, together with the Allow and Deny directives, controls the three-step access control system. The first step processes either all Allow directives or all Deny directives. The second step is parsing the remaining directive ( Deny or Allow ). The third step accepts all requests that do not match either the first or second.

Note that all directives, Allow and Deny , are processed, not typical of firewalls , where only the first directive is used. The result is the last match (also atypical to the behavior of firewalls).

Order Deny,Allow
Deny from all
Allow from 192.168.1.*


')
In this example, if you try to follow the logic of the firewall, access denial is implemented for all hosts, and the resolution 192.168.1. * Does not work, while, in accordance with the principles of the apache configuration files (including cupsd.conf), access to the hosts from subnet 192.168.1. * is allowed.

Additionally, the order in which the lines follow in the configuration file is not significant - all the Allow lines are executed as a single group, all the lines Deny , respectively, as another group, and the default state is considered separately.
The order can be one of:
Allow deny
First, all Allow directives are checked; at least one must match, or the request is rejected. Further, all Deny directives are implemented. If any match, then the request is rejected. In the end, any request that does not comply with the Allow or Deny directive is rejected by default.

Deny, Allow
First, all Deny directives are checked; if any match, then the request is rejected if there is no match in the Allow directive. Any request that does not comply with the Allow or Deny directive is skipped.

Keywords can only be separated by a comma, no spaces between them are allowed.

Conformity	Result Allow, Deny	Result Deny, Allow
Match only Allow	Request allowed	Request allowed
Only Deny compliant	Request rejected	Request rejected
No matches	By default, the second directive applies: rejected	By default, the second directive is valid: allowed
Match both Allow & Deny	Controls final match: rejected	Controls final match: allowed

In the example below, all hosts on the 192.168.1 subnet. * Access is allowed.

Order Deny,Allow
Deny from all
Allow from 192.168.1.*


In the following example, all hosts from subnet 192.168.1. * Access is allowed, except for hosts 192.168.1.5 and 192.168.1.24, all other hosts from other subnets are denied access, because for the server, the default state is Deny , deny access.

Order Allow,Deny
Allow from 192.168.1.*
Deny from 192.168.1.5
Deny from 192.168.1.24


On the other hand, if the order in the Order directive in the last example is changed to Deny, Allow , all hosts will be allowed access. This will happen because, apart from following the directives in the configuration file, this Allow directive from 192.168.1. * Will be checked last, and will block access denial from the 192.168.1.5 and 192.168.1.24 Deny directives. All non-192.168.1. * Hosts will also be allowed access, since The default state is Allow .

Original

Some moments may be incomprehensible after the first reading, however, their careful analysis, step by step, will not leave the student in doubt. Everything is logically true.