I have Apache2 running on a Debian server. My virtualhost (one for now) are already configured in /etc/apache2/sites-available/default and are working fine:
# /etc/apache2/sites-available/default
<VirtualHost *:80>
ServerName domain.com
DocumentRoot /var/www/
<Directory />
AllowOverride None
Order Deny,Allow
Deny from all
</Directory>
<Directory /var/www/>
AllowOverride None
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
However, by looking at the file /etc/apache2/conf.d/security, I've seen we can hardened Apache2 by also preventing access to file system root (may be especially useful when no ServerName match virtualhost configuration) by commenting out:
# /etc/apache2/conf.d/security
<Directory />
AllowOverride None
Order Deny,Allow
Deny from all
</Directory>
When I do that and reboot apache, all my pages returns the 403 Forbidden error. What I'm looking for is just prevent access to file system root and allow the VirtualHost "domain.com" to return pages in /var/www/. What I've misunderstood? What the way to secure Apache2 against unauthorized directories access? Thanks!