1

In my .htaccess file I've been trying to figure out if I should use:

Options None

which of course would disable all extra options, but I've been reading mixed opinions concerning the use of "Options None", because some people claim that +FollowSymlinks is needed for better security and performance, while some people claim that FollowSymlinks is a big security risk.

Should I use "Options None" for better security?

Thanks!

2 Answers 2

1

With security in mind, consider disabling .htaccess all together unless it is necessary within your site. (AllowOverride None) Then, you can set your options globally in Apache's configuration.

That said, symlinks aren't necessarily bad but you have to have a clear understanding of your implementation of Apache. To a non-chrooted Apache, symlinks certainly pose a significant risk to exposing files outside of your document root.

4
  • I'm on a shared server so I don't have access to the main Apache config. Can I still use the same principle for the root directory above public_html? A "global" .htaccess file in root with Options None, and then have another .htaccess file in public_html with AllowOverride None?
    – Zero
    Oct 27, 2010 at 22:39
  • A global setting will be in the Apache configuration under the <Directory> section. Consider contacting your hosting provider's support to see if they can make the change for your site. Most providers will do this if they can do it without effecting other customers. (And they should be able to in this case.) Oct 27, 2010 at 22:53
  • I found another link that is a good read straight from the Apache's mouth. :) httpd.apache.org/docs/2.2/howto/htaccess.html Oct 27, 2010 at 22:57
  • @user58259 - If you're on a shared server, most security decisions are out of your hands... please keep that in mind if you are thinking about handling any sensitive information.
    – danlefree
    Oct 28, 2010 at 4:00
1

Options None provides more security because then there is no chance to gain access outside of the document root through symlinks.

It may have a marginal effect on performance. I'd have to check but by disallowing symlinks apache may have to lstat each file to determine if it is a symlink first.

Can you cite these sources that claim allowing symlinks would be better security and performance?

Edit: However, be aware that disallowing symlinks isn't bulletproof. The apache manual says "Omitting this option should not be considered a security restriction, since symlink testing is subject to race conditions." I.e., between the time lstat saying it isn't a link and the time apache reads it somebody could have turned it into a link.

2
  • Would the performance hit be noticeable? I can't remember where I read that Symlinks are better for security/performance.
    – Zero
    Oct 27, 2010 at 22:40
  • I don't think performance would be noticeable unless you have millions of files. Otherwise the stat info will be cached. I performed a small test and confirmed the only difference was the an extra lstat. In the scheme of things one extra lstat won't make a difference. You'd be surprised how many stats apache does all over the place. Oct 27, 2010 at 23:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .