0

I noticed my apache system is delivering .htaccess files although it shouldn't, due to:

# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

which is the default Apache configuration. I have numerous virtual host below that. How can I find out why Apache still delivers .htaccess files?

Background: tried adding a Directory directive to block .svn folders and while wondering about why apache doesn't block them I came across that issue: It's not blocking anything at all, not even default .htaccess

mod_authz_host is loaded in /etc/apache2/mods-enabled/authz_host.load

LoadModule authz_host_module /usr/lib/apache2/modules/mod_authz_host.so
  • You likely have a higher precedence section, like a <Location>, allowing access to the files. Can you provide the simplest possible version of the "full" configuration, with other relevant server-wide sections and a virtualhost section? – Shane Madden Oct 20 '14 at 17:13
1

It should be:

<FilesMatch "^\.ht">
    Order allow,deny
    Deny from all
</FilesMatch>

This requires mod_authz_host to be loaded with something similar to:

LoadModule authz_host_module    libexec/apache22/mod_authz_host.so
| improve this answer | |
  • Same effect, added your code, restarted apache, it's still serving .htaccess files – Hokascha Oct 20 '14 at 17:02
  • Do you have mod_authz_host still loaded? – Chris S Oct 20 '14 at 17:05
  • I think so. At least it is loaded insinde /etc/apache2/mods-enabled/authz_host.load How can i verify? – Hokascha Oct 20 '14 at 17:10
  • Is there another Files type directive in the configuration, or in a .htaccess file (particularly near the data root)? – Chris S Oct 20 '14 at 17:15
  • yes, in global apache2.conf there is: <Files *> order deny,allow deny from 118.139.162.190 deny from 146.185.239.52 </Files> Removing the whole Files directive makes blocking .htaccess files work again. What's wrong with that second Files directive? – Hokascha Oct 20 '14 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.