What paths should I be ignoring on an Apache2 webserver?

Question

I'm deploying my WSGI-based Django application to an Apache2 server. Recently, I've noticed several requests going to /_vti_inf.html, which are apparently requests by Microsoft FrontPage or SharePoint to check for FrontPage extensions. Also, I've noticed requests by something called "Microsoft Data Access Internet Publishing Provider Protocol Discovery", which according to information found on the net is also a side-effect of SharePoint.

Since I (obviously) don't have any FrontPage extensions running on my Apache, I want Apache to handle (i.e. block) those instead of routing them to my Python process. But since we are living in a world with viruses, stupid bots, stupid desktop software etc., I wondered whether I should block a lot more than that. Can you recommend some important paths or maybe even a better solution to the problem?

Answer 1

I run a VM hosting about 100 sites, these sorts of things are always going to be there and are generally safe to ignore... HOWEVER I do run blockhosts and mod_evasive both of which use different methods to determine excessive 'nefarious' connections coming from specific ip addresses and can then block them by adding temporary entries in my hosts.allow files. If you want to filter out things like this [not recommended - save your resources for something important] then you can use mod_security to filter requests as well.

-sean

Answer 2

Well, as I just happened to get scanned the other day, I can tell you the list is well into the thousands. way more than I should post here, and you shouldn't by default just block 'em, as they might be valid on your host.

As Nessus is free for personal home use, scan your home server, then look at the logs at what sort of things it looks for. It'd be more up-to-date than anything I'd post here.

Answer 3

I think it's important to block any unix hidden files (ie files beginning with a period). I wrote about this here: http://dimmeria.com/node/1807 (please excuse the self-plug). This is especially so you don't leak access to any RCS files (eg git, svn)

Relatedly, I'd also block access to symlinks unless you need them (or fall back on SymLinksIfOwnerMatch). And you should deny all on the root directory <Directory /> and explicitly allow access only to the folders that apache should be accessing.

But public web services are public, after all. I think it would be time ill spent to try to block a subset of ineffective malicious traffic. Your django site will be getting plenty of 404s so it should be able to handle them. Your best bet is to keep django up-to-date and by following django security best practices.

Answer 4

Use mod_rewrite.

RewriteEngine On
RewriteRule ^/*_vti_inf.html /youarelame.html

Put something good in /youarelame.html.