Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a repository of files with .php, .sh, and .txt extensions which gets checked out to the web directory of my server (/var/www). I need the .php files to be able to be reached by typing in a url but I want the .sh and .txt files only to be accessible internally -- meaning they can be read and run by php or a cron but never by a user typing in their url. How can I do this on apache? Do I need to set the permissions of the files to something or mess with the .htaccess or do something else?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The correct way of doing this is by moving the files out of your document root -- you're just a configuration failure away from data leakage, which is never a fun place to be. Look at any modern web application framework for an example and execution.

However, to do this in Apache you just use a LocationMatch directive in the appropriate context:

<LocationMatch \.sh$>
    order deny,allow
    deny from all
</Location>
share|improve this answer
    
Ok thank you. The reason it wasn't like to begin with was it was part of a repository which I had to checkout to the web directory but maybe there is a way around this too... I also found that I can change the premission for 'others' and it can still run the shell scripts but not show them. –  hackartist Jul 14 '12 at 21:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.