I have been trying to prevent access to WordPress wp-admin and wp-includes directories on Ubuntu 13.04 with Apache2 2.2.22. First I tried to do this using .htaccess which for some reason wouldn't work but in reading Apache Docs they advise against. So I changed over to their suggestion of putting it in the <directory> section of the conf file. Can you see what I am doing wrong here?
- What is the best way to prevent access to a directory?
- What is the best way to prevent access to a single file?
- How do I get the server to enforce the rules such as preventing .htaccess access as well as prevent access to the version control directory listed below the vserver.conf?
The following is my vserver.conf file.
<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot /var/www/domain/
ServerName domain.com
ServerAlias www.domain.com
<Directory "/var/www/domain/">
# WordPress Permalink Configuration
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# wp-include rules remove if multisite
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
# END WordPress
Options FollowSymLinks
Order allow,deny
allow from all
</Directory>
<Directory "/var/www/domain/wp-admin">
Order Deny,Allow
Deny from all
# whitelist server IP for use with SSH tunel
Allow from 192.168.0.1
# whitelist home IP address
Allow from 192.168.1.1
</Directory>
<Directory "/var/www/domain/wp-content/plugins/akismet">
Order Deny,Allow
Deny from all
<FilesMatch "^akismet\.(css|js)$">
Allow from all
</FilesMatch>
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error-domain.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access-domain.log combined
</VirtualHost>
Also in the apache2.conf there is this rule to prevent access to .htaccess but I can still access the file from a browser.
AccessFileName .htaccess
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
<Files ~ "^\.ht">
Order allow,deny
Deny from all
Satisfy all
</Files>
And in conf.d/security there is a rule to prevent access to version control that generates a 500 error instead of 404 or 403
# Forbid access to version control directories
#
# If you use version control systems in your document root, you should
# probably deny access to their directories. For example, for git:
#
<DirectoryMatch "/\.git">
Require all denied
</DirectoryMatch>
Here are the mods available:
actions authn_alias authn_file authz_host cern_meta dav_fs disk_cache fcgid imagemap mem_cache php5_cgi proxy_ftp setenvif suexec
alias authn_anon authnz_ldap authz_owner cgi dav_lock dump_io file_cache include mime proxy proxy_http speling unique_id
asis authn_dbd authz_dbm authz_user cgid dbd env filter info mime_magic proxy_ajp proxy_scgi ssl userdir
auth_basic authn_dbm authz_default autoindex charset_lite deflate expires headers ldap negotiation proxy_balancer reqtimeout status usertrack
auth_digest authn_default authz_groupfile cache dav dir ext_filter ident log_forensic php5 proxy_connect rewrite substitute vhost_alias
And the mods enabled:
actions.conf alias.conf authz_host.load deflate.conf dir.conf env.load headers.load mime.load php5.load reqtimeout.load setenvif.conf status.conf
actions.load alias.load cgi.load deflate.load dir.load expires.load mime.conf php5.conf reqtimeout.conf rewrite.load setenvif.load status.load
As you can see no mod_access available.
