I have Apache2 running on a Debian server. My virtualhost (one for now) are already configured in /etc/apache2/sites-available/default and are working fine:
# /etc/apache2/sites-available/default <VirtualHost *:80> ServerName domain.com DocumentRoot /var/www/ <Directory /> AllowOverride None Order Deny,Allow Deny from all </Directory> <Directory /var/www/> AllowOverride None Order allow,deny Allow from all </Directory> </VirtualHost>
However, by looking at the file /etc/apache2/conf.d/security, I've seen we can hardened Apache2 by also preventing access to file system root (may be especially useful when no ServerName match virtualhost configuration) by commenting out:
# /etc/apache2/conf.d/security <Directory /> AllowOverride None Order Deny,Allow Deny from all </Directory>
When I do that and reboot apache, all my pages returns the 403 Forbidden error. What I'm looking for is just prevent access to file system root and allow the VirtualHost "domain.com" to return pages in /var/www/. What I've misunderstood? What the way to secure Apache2 against unauthorized directories access? Thanks!