7

The default apache.conf (ubuntu server), contains the following block:

# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.

# .... other items removed for brevity    

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

My intrepretation of this directive is that apache will allow web browsing of the items in /usr/share folder. yet If I try to browse and item in /usr/share/ I cant view anything?

  1. How do I browse the content in /usr/share?

    e.g. if I point a browser to localhost/synaptic/html/index.html I get a 404 not found error

  2. If apache allows browsing of this directory - do I need to lock it down on a production server?

4
  1. You need to map a URL path onto /usr/share. The simplest way to do that is to use an Alias directive, for example:

    Alias /share /usr/share
    

    Then http://localhost/share/synaptic will map to /usr/share/synaptic. See the documentation for Alias.

  2. All of the files in /usr/share should already be non-writeable for non-root users, including the Apache user, www-data. They're probably also all world-readable. So it should be fine to serve them all as above without any additional restrictions. But if there are public files in /usr/share that you don't want Apache users to see, you can use Require all deny directives to block access to those files.

  • works perfect! The tricky part was working out which config file/section/container to insert the Alias /share /usr/share line. I put it in the default virtual hosts file, inside the <virtualHost: *.80/> block and before the <Directory "/var/www/html"> container, thanks! (unable to upvote yet - not enough rep) – Michael Coleman Dec 27 '14 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.