Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Which settings should you use in `/etc/apache2/enabled-sites/000-default to make content only executable and readable for the user in the given folder?

I have the following /etc/apache2/sites-enabled/000-default

<VirtualHost *:80>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www       
             // I put here /var/www/codes unsuccessfully
             // I get this error when restarting Apache
             // waiting apache2: Could not reliably determine  
             // the server's fully qualified domain name, 
             // using 127.0.1.1 for ServerName

        --- cut ----
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order deny,allow
                allow from all                 // not sure about this
        </Directory>
        --- cut ---

My permissions at /var/www/codes

 4 drwxr-sr-x 3 root www  4096 2009-08-21 00:16 forms
 4 drwxr-sr-x 7 root www  4096 2009-08-21 00:16 handlers
 8 -rw-r--r-- 1 root www  5403 2009-08-22 00:43 index.php
share|improve this question
2  
I am having a hard time following what you (really want/are saying). I am sure others are having the same problem. –  user1797 Aug 21 '09 at 22:09
1  
It's not too clear to me either. But a couple of comments: (1) the setup you have does not itself allow malware onto your system. If there is a malicious CGI script in /usr/lib/cgi-bin, that script could allow malware on to the system, but that's not Apache's fault. The configuration as you have it is basically fine. (2) It is safe to share your IP address on ServerFault (unless you do not want anyone accessing your server). An IP address is not some sort of secret information that allows hackers special access; it's a basic identifier that anyone who will ever visit your site must have. –  David Z Aug 21 '09 at 23:24
    
@David: My problem is that I have no idea how to read logs to see if someone has had an access to my computer. I want to open only little my ports such that people can access the site, but not hack to my PC. –  Masi Aug 21 '09 at 23:29
    
@Masi: Learning how to read log files is dead simple - I'm sure you could do a Google search and get tons of information. Also: if you're talking about opening ports, it sounds like you mean to ask about a firewall, not Apache? –  David Z Aug 22 '09 at 4:32
    
Thank you for your answers! –  Masi Aug 22 '09 at 17:17
add comment

1 Answer

up vote 1 down vote accepted

If you only want people to be able to access apache, and nothing else then you need to use a firewall. You could use ufw - uncomplicated firewall to only allow port 80 in.

However it's not a big deal if you don't have a firewall on linux, since it's quite secure by default.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.