Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In my .htaccess file I've been trying to figure out if I should use:

Options None

which of course would disable all extra options, but I've been reading mixed opinions concerning the use of "Options None", because some people claim that +FollowSymlinks is needed for better security and performance, while some people claim that FollowSymlinks is a big security risk.

Should I use "Options None" for better security?

Thanks!

share|improve this question

2 Answers 2

up vote 1 down vote accepted

With security in mind, consider disabling .htaccess all together unless it is necessary within your site. (AllowOverride None) Then, you can set your options globally in Apache's configuration.

That said, symlinks aren't necessarily bad but you have to have a clear understanding of your implementation of Apache. To a non-chrooted Apache, symlinks certainly pose a significant risk to exposing files outside of your document root.

share|improve this answer
    
I'm on a shared server so I don't have access to the main Apache config. Can I still use the same principle for the root directory above public_html? A "global" .htaccess file in root with Options None, and then have another .htaccess file in public_html with AllowOverride None? –  Zero Oct 27 '10 at 22:39
    
A global setting will be in the Apache configuration under the <Directory> section. Consider contacting your hosting provider's support to see if they can make the change for your site. Most providers will do this if they can do it without effecting other customers. (And they should be able to in this case.) –  Aaron Copley Oct 27 '10 at 22:53
    
I found another link that is a good read straight from the Apache's mouth. :) httpd.apache.org/docs/2.2/howto/htaccess.html –  Aaron Copley Oct 27 '10 at 22:57
    
@user58259 - If you're on a shared server, most security decisions are out of your hands... please keep that in mind if you are thinking about handling any sensitive information. –  danlefree Oct 28 '10 at 4:00

Options None provides more security because then there is no chance to gain access outside of the document root through symlinks.

It may have a marginal effect on performance. I'd have to check but by disallowing symlinks apache may have to lstat each file to determine if it is a symlink first.

Can you cite these sources that claim allowing symlinks would be better security and performance?

Edit: However, be aware that disallowing symlinks isn't bulletproof. The apache manual says "Omitting this option should not be considered a security restriction, since symlink testing is subject to race conditions." I.e., between the time lstat saying it isn't a link and the time apache reads it somebody could have turned it into a link.

share|improve this answer
    
Would the performance hit be noticeable? I can't remember where I read that Symlinks are better for security/performance. –  Zero Oct 27 '10 at 22:40
    
I don't think performance would be noticeable unless you have millions of files. Otherwise the stat info will be cached. I performed a small test and confirmed the only difference was the an extra lstat. In the scheme of things one extra lstat won't make a difference. You'd be surprised how many stats apache does all over the place. –  Mark Wagner Oct 27 '10 at 23:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.