Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been trying to prevent access to WordPress wp-admin and wp-includes directories on Ubuntu 13.04 with Apache2 2.2.22. First I tried to do this using .htaccess which for some reason wouldn't work but in reading Apache Docs they advise against. So I changed over to their suggestion of putting it in the <directory> section of the conf file. Can you see what I am doing wrong here?

  • What is the best way to prevent access to a directory?
  • What is the best way to prevent access to a single file?
  • How do I get the server to enforce the rules such as preventing .htaccess access as well as prevent access to the version control directory listed below the vserver.conf?

The following is my vserver.conf file.

<VirtualHost *:80>
ServerAdmin webmaster@domain.com
DocumentRoot /var/www/domain/
    ServerName domain.com
    ServerAlias www.domain.com
<Directory "/var/www/domain/">
    # WordPress Permalink Configuration
    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]

    # wp-include rules remove if multisite
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
    </IfModule>
    # END WordPress

    Options FollowSymLinks
    Order allow,deny
    allow from all
</Directory>

<Directory "/var/www/domain/wp-admin">
    Order Deny,Allow
    Deny from all
    # whitelist server IP for use with SSH tunel
    Allow from 192.168.0.1
    # whitelist home IP address
    Allow from 192.168.1.1
</Directory>

<Directory "/var/www/domain/wp-content/plugins/akismet">
    Order Deny,Allow
    Deny from all

    <FilesMatch "^akismet\.(css|js)$">
    Allow from all
    </FilesMatch>
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error-domain.log

# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access-domain.log combined
</VirtualHost>

Also in the apache2.conf there is this rule to prevent access to .htaccess but I can still access the file from a browser.

AccessFileName .htaccess

# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy all
</Files>

And in conf.d/security there is a rule to prevent access to version control that generates a 500 error instead of 404 or 403

# Forbid access to version control directories
#
# If you use version control systems in your document root, you should
# probably deny access to their directories. For example, for git:
#
<DirectoryMatch "/\.git">
Require all denied
</DirectoryMatch>

Here are the mods available:

actions          authn_alias      authn_file       authz_host       cern_meta        dav_fs           disk_cache       fcgid            imagemap         mem_cache        php5_cgi         proxy_ftp        setenvif         suexec
alias            authn_anon       authnz_ldap      authz_owner      cgi              dav_lock         dump_io          file_cache       include          mime             proxy            proxy_http       speling          unique_id
asis             authn_dbd        authz_dbm        authz_user       cgid             dbd              env              filter           info             mime_magic       proxy_ajp        proxy_scgi       ssl              userdir
auth_basic       authn_dbm        authz_default    autoindex        charset_lite     deflate          expires          headers          ldap             negotiation      proxy_balancer   reqtimeout       status           usertrack
auth_digest      authn_default    authz_groupfile  cache            dav              dir              ext_filter       ident            log_forensic     php5             proxy_connect    rewrite          substitute       vhost_alias

And the mods enabled:

actions.conf  alias.conf  authz_host.load  deflate.conf  dir.conf  env.load  headers.load  mime.load  php5.load    reqtimeout.load  setenvif.conf  status.conf
actions.load  alias.load  cgi.load     deflate.load  dir.load  expires.load  mime.conf     php5.conf  reqtimeout.conf  rewrite.load     setenvif.load  status.load

As you can see no mod_access available.

share|improve this question

2 Answers 2

is mod_access enabled? http://httpd.apache.org/docs/2.0/mod/mod_access.html

Off the top of my head I am guessing it is not. That's odd. Most versions of apache I've seen come with mod_access compiled in...

share|improve this answer
    
According to that page it is only available in versions prior to 2.1 according to Apache Docs Module authz_host is what I need and it is loaded. Although it might be some configuration issue there. I updated my question with my enabled and available mods. You can check httpd.apache.org/docs/2.2/mod/mod_authz_host.html for information on it. –  Mark Finch Sep 24 '13 at 4:40

You can protect your directory by specifying DirectoryIndex

<Directory somepath/wp-admin>
   DirectoryIndex /pathtosomefilesay/404.html
</Directory>

so in above case it will always return the 404.html whenever you will try to excess wp-admin directory. You can also specific whom to allow. Hope this helps

share|improve this answer
    
The problem is that for some reason Apache isn't applying the rules. Or the configuration would work, give an error or whatever. Also with your answer while decent for the casual user isn't going to help much with all the hackers that are going after certain files in those directories with scripts. While the hacks they are attempting don't work on the version of WordPress I am using that isn't to say they will never find a weakness and then exploit it. I was hoping it was @lvlint67 suggestion as it certainly makes the most sense but on further inspection the necessary module is loaded. –  Mark Finch Sep 24 '13 at 14:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.