Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the logs we see on our server that a plenty of requests comes to access upload.php (eg.: /plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload.php), or a plenty of varions for setup.php for phpMyAdmin.

These are 404 errors in the log, because we don't have these exact URLs, however, we would feel safer if we could deny all potential attack of this type.

So I would like to deny every requests which contains setup.php or upload.php on my Apache2 webserver.

We have several (hundreds) of VirtualHost, and I would prefer not to write hundreds of times the directive to deny these filenames in every VirtualHost.

Question: How can I do it the globally on the server?

share|improve this question
up vote 1 down vote accepted

you can install your rewrite rules for upload.php and setup.php in a directory context defined at serverconfig level. This should check the requests no matter what the vhost is. directory should match those applications paths only so you won't deny access to other scripts with the same name but installed within other applications

<directory ~ "phpmyadmin_path_global_regex">
rewritengine on
options followsymlinks
rewriterule "setup.php$" - [F]
<directory ~ "tiny_mce/plugins/tinybrowser">
rewriteengine on
options followsymlinks
rewriterule "upload.php$" - [F]
#vhost defs at the same level

however, this is... global. if you later want to install a phpmyadmin and set it up you will have to disable the filters above or add rewriteconds for the hosts you don't want to forbid access. same if you want to have a tinybrowser within a vhost.

that is, for allowing setup.php requests for vhost you should add

rewritecond %{HTTP_HOST} "!"

I'd say the best thing to do is to ignore the 404 log entries and make sure you have no exploitable phpmyadmin or tinybrowser installs on your server. use a cron script to make sure you don't have any setup.php's forgotten in docroots, if you do then chmod them to 0 or remove them. make another cron to make sure you aren't running any exploitable phpmyadmin/tinybrowser versions. same can be applied for a wider range of apps.

on the other hand, if logging those bogus requests bothers you then you can do some custom logging. to skip logging the bogus requests:

setenvif Request_URI tiny_mce/plugins/tinybrowser/upload\.php$ bogus-ignore
customlog access.log common env=!bogus-ignore
#if you still want to log upload.php requests but in another log file then add:
customlog bogus-ignore.log common env=bogus-ignore
share|improve this answer
Thanks. I would like to deny every file named setup.php, no matter what dir it is in. If I have tinymce in some of my sites, rather I would rename the upload.php file and the references in the app as well. So What should I write to <directory> tag to match all of the directoried? – netmano Nov 9 '11 at 13:25
<directory "/"> – sysfault Nov 9 '11 at 13:33
you could also use files directive like this: <files ~ "setup\.php$">deny from all</files> – sysfault Nov 9 '11 at 13:36
every time someone accepts an answer without upvoting a kitten dies a horrible death. save the kittens! – sysfault Nov 9 '11 at 14:27
I have 12 reputation, under 15 I can NOT upvote, sorry, I would. :(, after I will have, I will come back and do +1 – netmano Nov 9 '11 at 14:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.