How to secure bash scripts on apache?

Question

How to close access for a few bash scripts that are used by my PHP-Apache-based website?

I have an index.php file in my document root /var/www/. index.php is supposed to call some bash scripts which are currently in the /var/www/scripts/ directory. However I don't like the fact that these scripts can be downloaded from the Internet by requesting http://mysite.com/scripts/script1.sh.

How to close access to the scripts, allowing them to be called by index.php?

Answer 1

You should be able to use the FilesMatch directive:

http://httpd.apache.org/docs/2.2/mod/core.html#filesmatch

with an Order and Allow and Deny directives.

Cheers

Answer 2

You should place the scripts outside of the site's directory so they cannot be download no matter what happens with the server configuration or permissions. You can still execute them from your PHP code so long as the apache process has execute permission on them.

Answer 3

If you exec these scripts from within the PHP script, no one should have an idea of their existance. Anyway you can put a .htaccess file with a Deny ALL directive to restrict everybody's access from Apache to that directory. It is another question why you would need a scripts directory under your DocumentRoot, but I assume there are some hosting providers that don't give you another directory...

Answer 4

Might not hurt to obfuscate the scripts with this shell script 'compiler' called shc. (not really a compiler).