Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When someone fetches a denied URL that exists, he gets:

Forbidden

You don't have permission to access /admin/admin.php on this server.
Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch Server

When someone goes to a URL that does not exist he will get:

Not Found

The requested URL /notexisting/notthere.php was not found on this server.
Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch Server 

This way someone can find out information about the directory structure in an area, that is actually not open to the public. Is this true?

If I were paranoid, what could I do? Just curious.

share|improve this question
add comment

3 Answers 3

up vote 0 down vote accepted

You could probably use SetEnvIf to check for something, like whether Remote_Addr is internal or not, and then use mod_rewrite to give 404's based on the environment variable.

share|improve this answer
add comment

You can configure the way Apache reacts to error, for example by setting an ErrorDocument for each error: http://httpd.apache.org/docs/2.0/mod/core.html#errordocument

share|improve this answer
    
but this would not change the http result code? an attacker could still look for it? –  user12096 Apr 26 '10 at 9:15
add comment

Note this doesn't necessarily tell them that /admin/admin.php exists. If /admin were forbidden, /admin/notthere.php would also be a 403 Forbidden. So it's not explicitly giving away any information about your directory structure.

If you are paranoid, you could create a subdomain where the root is protected. That way, for an unauthorized user, any url will result in a 403 Forbidden message

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.