0

Just a note, I have been a programer for years but always had a real sysadmin to take care of the servers, with my newest job, that is up to me, so this may seem simple, but I'm doing by best to things right. (I know I don't like it ether)

So the question.

I have set up a Apache server and have been Securing it and have read a few places that say I should remove WebDav from Apache (specifically by removing the Apache mod). I is this a good idea, is there any major disadvantages I should know about.

Also I am running a website that is exposed to the net and a admin website that can only be accessed from my local network, is there any way to disallow file upload completely on the web facing site and still have it enabled on the admin site.

Server: Debian, Apache 2.2, PHP. I error on the side of safety, as long as its not going to be big issue.

Edit: Each site is running on virtual hosts.

Improve this question

1 Answer 1

Reset to default
1

Disabling the webDav module is not a problem, it's rarely used. This doesn't affect the normal kind of file uploads that are done by HTTP Post, those will still work fine.

If you want to disable file uploads for one of your virtual hosts, then you can use LimitRequestBody. Set this to a reasonable size like 5k and the forms on the site will still work, but files larger than that can't be uploaded.

Improve this answer
1
  • Thanks for the link, it was quit helpful. I ended up using LimitRequestFieldsize seeing as I am letting a lot of images be uploading by the admin, that with LimitRequestFields for the public site get me where I needed to be. Thank you I would have know of these directives without them right next to the link you gave.
    – webLacky3rdClass
    Dec 13, 2013 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.