Resolving Apache AllowOverride None: .htaccess Ignored in Subdirectories on CentOS Stream / Rocky Linux

Troubleshoot Apache .htaccess files being ignored in subdirectories due to `AllowOverride None` on CentOS Stream and Rocky Linux. Restore critical per-directory configuration.

As an experienced Systems Administrator managing web hosting environments, you've likely encountered the frustration of .htaccess files not behaving as expected, especially on RHEL-based systems like CentOS Stream or Rocky Linux. This guide dives deep into a common root cause: Apache's AllowOverride None directive, which explicitly prevents .htaccess files from overriding server configurations. When this setting is active, any .htaccess file in your subdirectories will be completely ignored, leading to broken permalinks, failed redirects, incorrect PHP settings, or security access issues.

Symptom & Error Signature

The primary symptom is that directives you've placed in your .htaccess files within web document roots or subdirectories are simply not being applied. There isn't usually a direct error message from Apache saying ".htaccess ignored," but rather the consequences of it being ignored.

Common manifestations include:

• HTTP 403 Forbidden errors: When .htaccess was intended to grant access, set specific permissions, or perform authentication that is now failing.
• Broken "Pretty URLs" or Permalinks: Applications like WordPress, Laravel, or custom MVC frameworks relying on mod_rewrite rules in .htaccess to handle clean URLs will result in 404 Not Found errors or display default index pages.
• Incorrect PHP Configuration: php_value or php_flag directives in .htaccess (e.g., increasing upload_max_filesize, disabling display_errors) are not taking effect.
• Missing Redirects or Rewrites: Expected 301/302 redirects or URL rewrites defined in .htaccess are not executing.
• Directory Browsing Issues: Options -Indexes in .htaccess fails to prevent directory listings, or other Options directives are ignored.

You might not see specific errors in error_log unless mod_rewrite is also disabled or there's a syntax error within the .htaccess file itself (which would be reported regardless of AllowOverride). The key is the absence of expected behavior.

Root Cause Analysis

The underlying reason for .htaccess files being ignored is typically a configuration directive within Apache's main configuration files: AllowOverride None.

1. Apache's Configuration Hierarchy: Apache processes configuration directives in a specific order. The main server configuration (httpd.conf and its includes) is parsed first. Within this configuration, <Directory> blocks define settings for specific filesystem paths.
2. AllowOverride Directive: This directive controls what types of directives placed in .htaccess files are allowed to override the main server configuration for a given directory.
   • AllowOverride None: This is the default setting for many web roots on CentOS/Rocky Linux (e.g., /var/www/html). It explicitly states that no directives in .htaccess files are permitted to override the main configuration. Apache will entirely ignore .htaccess files within that directory and its subdirectories.
   • AllowOverride All: This setting allows any directive that can be placed in .htaccess files to override the main configuration. While convenient, it can have security implications (see warnings below).
   • AllowOverride FileInfo AuthConfig Indexes Options Limit: More granular options allow specific types of .htaccess directives. For instance, FileInfo is required for RewriteRule, Redirect, ErrorDocument; AuthConfig for AuthType, AuthName, Require; Indexes for Options Indexes; etc.
3. Default Security Posture: On RHEL-based distributions like CentOS Stream and Rocky Linux, the default httpd.conf typically sets AllowOverride None for the /var/www/html directory. This is a security-conscious default, preventing potentially malicious or misconfigured .htaccess files from altering server behavior, especially in shared hosting environments where users might have FTP access but not SSH root access.
4. Virtual Hosts: The AllowOverride directive can also be set within <VirtualHost> blocks, often inheriting or overriding global settings. It's crucial to check the specific virtual host configuration for your site if you're running multiple domains.

Step-by-Step Resolution

To resolve the issue, you need to modify the AllowOverride None directive to AllowOverride All (or a more specific set of options) within the relevant Apache configuration file.

1. Locate Apache's Main Configuration Files

First, determine where your Apache configuration files reside.

sudo httpd -V | grep -E "HTTPD_ROOT|SERVER_CONFIG_FILE"

You'll typically see output similar to this:

-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

This indicates the main configuration file is /etc/httpd/conf/httpd.conf. Additionally, Apache often includes other configuration files from /etc/httpd/conf.d/ and /etc/httpd/conf.modules.d/.

2. Identify the Relevant Directory or Virtual Host Block

Open the main Apache configuration file (e.g., /etc/httpd/conf/httpd.conf) and look for <Directory> blocks, especially for your web root (commonly /var/www/html). If you're using virtual hosts, check the specific <VirtualHost> block and any <Directory> blocks defined within it.

sudo vi /etc/httpd/conf/httpd.conf

Search for the default <Directory "/var/www/html"> block:

<Directory "/var/www/html">
    AllowOverride None
    # ... other directives ...
</Directory>

Or, if your site is in a different path, find the corresponding <Directory> block. If you are using Virtual Hosts, you might have something like this in /etc/httpd/conf.d/vhosts.conf or similar:

<VirtualHost *:80>
    ServerName yourdomain.com
    DocumentRoot /var/www/yourdomain.com/public_html

    <Directory "/var/www/yourdomain.com/public_html">
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

3. Modify the AllowOverride Directive

Change AllowOverride None to AllowOverride All within the appropriate <Directory> block.

While AllowOverride All is the simplest solution and often necessary for popular CMS systems like WordPress, it significantly increases the attack surface by allowing any .htaccess directive to override server settings. For maximum security, it is recommended to use more specific options if you know exactly what directives your .htaccess files require. Common specific options include:

• AllowOverride FileInfo: Allows RewriteRule, Redirect, ErrorDocument, etc.
• AllowOverride AuthConfig: Allows AuthType, AuthName, Require, etc.
• AllowOverride Indexes: Allows Options Indexes or -Indexes.
• AllowOverride Options: Allows Options directives (e.g., +FollowSymLinks, -MultiViews).
• AllowOverride Limit: Allows Order, Deny, Allow directives.

For most general web applications, AllowOverride All is usually adopted for simplicity, but understand the trade-offs.

Example Change:

<Directory "/var/www/html">
    # Change this line:
    AllowOverride All
    # To be more secure, you could use:
    # AllowOverride FileInfo AuthConfig Indexes Options Limit

    Require all granted
</Directory>

If you're editing a virtual host configuration:

<VirtualHost *:80>
    ServerName yourdomain.com
    DocumentRoot /var/www/yourdomain.com/public_html

    <Directory "/var/www/yourdomain.com/public_html">
        AllowOverride All # Or more specific options
        Require all granted
    </Directory>
</VirtualHost>

4. Ensure mod_rewrite is Enabled (if applicable)

Many .htaccess issues, especially with clean URLs, stem from mod_rewrite being disabled. On CentOS/Rocky, mod_rewrite is typically enabled by default. You can verify this in httpd.conf:

sudo grep -i "LoadModule rewrite_module" /etc/httpd/conf/httpd.conf

Ensure the line LoadModule rewrite_module modules/mod_rewrite.so is present and not commented out (no # at the beginning). If it's commented, uncomment it.

5. Verify Apache Configuration Syntax

Before restarting Apache, always check for syntax errors in your modified configuration files.

sudo httpd -t
# OR
sudo apachectl configtest

You should see Syntax OK. If there are errors, Apache will report the file and line number. Correct any reported issues before proceeding.

6. Restart Apache Service

Apply the changes by restarting the Apache HTTP Server.

sudo systemctl restart httpd

If Apache fails to restart, check the journalctl -xe output or Apache's error logs (/var/log/httpd/error_log) for clues. This usually indicates a syntax error you missed in the previous step.

7. Test Your Website

Clear your browser cache and cookies, then navigate to your website. Verify that your .htaccess directives are now functioning correctly:

• Test your "pretty URLs" (e.g., WordPress permalinks).
• Check if custom error pages are working.
• Verify any redirects or access restrictions.
• Confirm PHP settings overridden via .htaccess are now active (e.g., using phpinfo()).

Your Apache server on CentOS Stream or Rocky Linux should now correctly interpret and apply the rules defined in your .htaccess files.