Reputation
532
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 11 26
Newest
 Civic Duty
Impact
~64k people reached

Oct
1
awarded  Taxonomist
Sep
19
comment Tried to deny access to apache /server-status module with certain exceptions, but it became exposed everywhere
Hmmm, seemed promising that allow locations might be space delimited instead of comma+space delimited, but in actuality it didn't make a difference.
Sep
18
asked Tried to deny access to apache /server-status module with certain exceptions, but it became exposed everywhere
Aug
22
awarded  Notable Question
Aug
20
revised Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
deleted 1 character in body
Aug
20
revised Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
added 391 characters in body
Aug
20
comment Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
There are two advantages that I can see to not providing the basic auth password & username on every admin url: 1: brute forcing of the basic auth cannot be done until the wp-adminsecretlogin/ url is accessed, and since that url will be a custom one for the site/blog network, that would require prior knowledge of the login url and would generally require tailoring the attack to the unique site/blog network. 2: Returning 404 will mask the standards signals to bots that a wordpress admin section is present, to discourage the frequent brute force scripting attempts that tend to occur.
Aug
20
asked Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
Jul
23
awarded  Nice Question
Jul
2
awarded  Curious
Jun
11
awarded  Famous Question
May
13
awarded  Popular Question
Apr
30
awarded  Popular Question
Nov
5
awarded  Yearling
Oct
14
awarded  Notable Question
Sep
16
awarded  Popular Question
Aug
20
awarded  Notable Question
Aug
8
awarded  Notable Question
Aug
6
comment Dealing with development subdomains
Note that apache 2.4 requires .conf on the end of virtualhosts for them to work, which is what caused me the problem a second time. Found the documentation for the change in: vi /usr/share/doc/apache2/NEWS.Debian.gz
Jul
11
comment What are the correct permissions for /etc/init.d/ scripts?
This is giving execute permissions to world (what?) and group (ok, sure). Why would that ever be a good thing, or necessary in this case?