Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been experimenting with the FilesMatch Directive. During my first attempt, I discovered that my default rules (rulesets 1 & 2) didn't allow me to access www.test.com/ but did allow me to access www.test.com/index.php

I presumed this was because the file "/" hit ruleset 1 but not ruleset 2 and so got blocked. I therefore put ruleset 3 in place and everything seems to be working now. I just wanted to ask if anyone had any advice on implementing this directive, and whether or not I've gone about it the correct way?

#Ruleset1
<FilesMatch "^.*$">
        Order Deny,Allow
        Deny from all
</FilesMatch>

#Ruleset2
<FilesMatch "^.*\.(css|html?|js|pdf|txt|xml|xsl|gif|ico|jpe?g|png|php?)$">
        Order Deny,Allow
        Allow from all
</FilesMatch>

#Ruleset3
<FilesMatch "">
        Order Deny,Allow
        Allow from all
</FilesMatch>
share|improve this question

1 Answer 1

This likely isn't working as you're intending.

Your last match effectively overrides the other rules and allows all requests; "" will always match everything (as will your first section, "^.*$").

Just using <FilesMatch> seems like the wrong approach for what you're going for, but can you clarify what you're trying to achieve?

Edit:

Something like this should function for both cases:

<Location />
    Order deny,allow
    Deny from all
</Location>
<LocationMatch "(/|\.css|\.html?|\.js|\.pdf|\.txt|\.xml|\.xsl|\.gif|\.ico|jpe?g|\.png|\.php)$">
    Allow from all
</LocationMatch>
share|improve this answer
    
I'm trying to put in place some CIS guidelines. Namely these ones: 1.5.11 Restrict File Extensions (Level 2, Scorable) Description: Restrict access to inappropriate file extensions that are not expected to be a legitimate part of web sites using the FileMatch directive. They work in part, but the also block a site when a user accesses www.test.com/ because the "/" doesn't match a rule in the whitelist. –  leftcase Jun 28 '12 at 9:26
    
@leftcase Edited answer with a config that should fit your needs. –  Shane Madden Jun 28 '12 at 18:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.