Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some web software with its own .htaccess. No on our internal test servers we want to configure some access permissions (htaccess passwords)

We want to avoid modifications specific to the test-server in the .htaccess.

We do this in the vhost configuration of Apache 2.

.htaccess contains:

Order allow,deny
Allow from all

How can we block those settings? Is there a blacklist-based way to the AllowOverride directive? Something like DontAllowOverride Order Allow ?

share|improve this question
add comment

2 Answers

Well, there is an excellent documentation available for everyone.

AllowOverride Limit

would allow Order/Deny/Allow instructions.

AllowOverride AuthConfig, FileInfo, Indexes

Will allow anything except Order/Deny/Allow instructions' and also any Options as they need to be listed.

But as stated by @jeffatrackaid it would certainmly be better to AllowOverride Nonoe.

You would get more speed from Apache and put all needed configurations in Virtualhosts/Directory/Locations sections. .htaccess files have nothing to do with .htpassword security.

share|improve this answer
add comment

I am pretty sure that vhost directory configurations are processed after htaccess files. So in this case, you cannot restrict users since the htaccess file would allow them all.

You may want to look into either:

  1. blocking htaccess on a per-directory basis.
  2. Checking into the Require and Satisfy arguments. If you add password protection in your vhost configuration, you can use the Satisfy argument to require the user both match the htaccess criteria and the password.

Of course test.

In general, I recommend disabling htaccess on the directory your are trying to secure if are not sure that the users will not overwrite the file. If there are directives you require in the htaccess file, you can always make it owned by a user that does not have write access so it cannot be changed.

For some clients, when we cannot remove htaccess entirely, we often set the htaccess file to be owned by an admin level user and chmod 644. This prevents the everyday webmaster from changing the file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.