1

I'm using a somewhat default-looking VirtualHost file that I configured a while back (before I had much knowledge of how this stuff works), and I'm not exactly sure what I should keep around. I don't want to just try things because setting up a VM with all this stuff in it would be a hassle, and the current configuration is in a production environment so trial-and-error isn't really an option. Here is the file, with names changed to protect the innocent:

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName www.my.hostname
    ServerAlias my.hostname
    DocumentRoot /var/www/mysite
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/mysite>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    LogFormat "%t   %T/%D   \"%r\"   %>s   %b" mysitelog
    CustomLog ${APACHE_LOG_DIR}/mysite.access.log mysitelog

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

My questions about it are:

  1. Should I get rid of the <Directory /> block? It's specified in $APACHE_HOME/conf.d/security with the comment "This currently breaks the configurations that come with some web application Debian packages." Should I uncomment this version of it and remove the one from my vhost?

  2. This is nothing but PHP, so I'm guessing there's no reason to keep the cgi block and alias around.

  3. I'm guessing I can also get rid of the doc stuff as well. I'm not even really sure what that's there for, so bonus points (not really) if you can explain what that would be used for in a "normal" setup.

So, assuming I'm right in everything I'm thinking, my new vhost file could look like this:

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName www.my.hostname
    ServerAlias my.hostname
    DocumentRoot /var/www/mysite

    <Directory /var/www/mysite>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    LogFormat "%t   %T/%D   \"%r\"   %>s   %b" mysitelog
    CustomLog ${APACHE_LOG_DIR}/mysite.access.log mysitelog

</VirtualHost>

Any other tips are very welcome. Thanks! Please let me know if more information from my configuration is needed!

1 Answer 1

2

Should I get rid of the <Directory /> block?

Sure! That's definitely something that you can handle at the server level instead of in the vhost.

This is nothing but PHP, so I'm guessing there's no reason to keep the cgi block and alias around.

Nuke it.

I'm guessing I can also get rid of the doc stuff as well.

Nuke it. It's there so you can use your newly installed web server to browse your system's documentation. It's a cute example, but really doesn't belong in a default config file in my opinion.

On your proposed config file: looks good! The one recommendation I'd make is to change the AllowOverride All in your directory block to AllowOverride None if you aren't using .htaccess files - and if you are using .htaccess files, I'd recommend nuking them and pulling their config into the directory block. (see here for details on why I say that)

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .