0

Fedora 29 with HTTPD Apache 2.4

By default access to the server's directory system is protected by this entry in httpd.conf:

<Directory />
    AllowOverride none
    Require all denied
</Directory>

...and is overwritten on a per-directory basis with further <directory> rules; so I have virtual host blocks as shown below and I would like to run a test to ensure that <Directory "/"> is not allowing access outside of the DocumentRoot. How do I do this?

<VirtualHost insurgent.info:80>
    DocumentRoot "/var/httpd/insurgent"
    ServerName insurgent.info

<Directory "/"> 
    Require all granted
    Options Indexes FollowSymLinks IncludesNoExec
    AllowOverride None
    XBitHack Full
</Directory>

<Directory "/var/httpd/insurgent/.cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/httpd/insurgent/.cgi-bin/"
</IfModule>
</VirtualHost>
0

Directory points to a directory in your filesystem, so in virtualhosts you specify

<Directory /var/httpd/insurgent>
Require all granted
#other directives 
</Directory>

to allow access to your documentroot.

The official documentation is very specific with this: http://httpd.apache.org/docs/2.4/mod/core.html#directory

The entry pointing to /, should only be in server config context

<Directory />
    AllowOverride none
    Require all denied
</Directory>

and is really needed to forbid access anywhere else, but don't use it in Virtualhosts!

  • Thanks, - I have all that; but what I was wanting to know was whether there was some way in which I could verify whether or not the entries were actually working in a real-world context as part of hardening the server against attacks. - It is all well and good looking at looking at the code and saying "yes, in theory everything is contained" but it is useless unless you can actually confirm that. – Y Treehugger Cymru May 6 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.