Updated Apache from 2.2 to 2.4 and now my sub domains are broken

Question

Upon trying to visit any of my subdomains here is the error recieve in my error.log file:

[Tue Jul 15 11:17:42.924790 2014] [core:alert] [pid 17309] [client 108.162.241.152:26427] /var/www/.htaccess: <IfModule not allowed here
[Tue Jul 15 11:17:43.672653 2014] [core:alert] [pid 13948] [client 108.162.242.152:38399] /var/www/.htaccess: <IfModule not allowed here

Visiting the subdomains via the browser simply states there was an internal server error.

Here is my conf file for one of my subdomains:

$ less sites-enabled/paste.jhvisser.com.conf
<VirtualHost *:80>
DocumentRoot "/var/www/paste"
ServerName paste.jhvisser.com
<Directory "/var/www/paste">
allow from all
Options +Indexes
</Directory>
</VirtualHost>

I have DNS records that point to the servername. These only stopped working upon upgrading from Ubuntu 12.04 LTS to Ubuntu 14.04 LTS which upgraded apache 2.2 to apache 2.4.

I am confused as to what the problem is here?

Solution

One of the biggest changes from Apache 2.2 to 2.4 is the way that permissions for directories are granted. The allow from and deny from syntax is now deprecated in favor of the new require syntax. See Upgrading Apache from 2.2 to 2.4.

There is a module mod_access_compat that is supposed to allow you to still use the old syntax. Unfortunately, it didn't work for me for configuration files under /etc/apache2. I had to go through them and update them with the new Require syntax.

If you replace

allow from all

with

Require all granted

your subdomains will likely work much better. Look for any instances of Allow, Deny, or Order. All of them should be replaced with the new syntax for Require. The upgrade documentation has more examples for other use cases.

I personally find that the new Require syntax is much better. It seems clearer to me and it should be easier to handle complex cases based on passwords or IP addresses. The down side of the change is that the old syntax needs an update in your configuration files.

On the plus side, the access compat module did handle all the old style directives that I had in .htaccess files, so only the config files in /etc/apache2 had to be updated for me.

Comments

[ComputerLocus]

I just moved all my .htaccess data into the vhost files and then swapped all the grants. Thanks.