From: dgaudet Date: Sun, 16 Mar 1997 23:34:02 +0000 (+0000) Subject: Add security notes about protecting /, and avoiding "UserDir ./". X-Git-Tag: APACHE_1_2b8~12 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=dc7486d62d452dbc006c1ec76023d6107e53bb93;p=apache Add security notes about protecting /, and avoiding "UserDir ./". Submitted by: Ken Coar Obtained from: git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@77725 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/misc/security_tips.html b/docs/manual/misc/security_tips.html index f638e2b16d..4a730f8636 100644 --- a/docs/manual/misc/security_tips.html +++ b/docs/manual/misc/security_tips.html @@ -1,17 +1,17 @@ -Apache HTTP Server Documentation +Apache HTTP Server: Security Tips -

Security tips for server configuration

Security Tips for Server Configuration

Some hints and tips on security issues in setting up a web server. Some of -the suggestions will be general, other, specific to Apache +the suggestions will be general, others specific to Apache.

@@ -21,7 +21,7 @@ server before switching to the user defined in the User directive. Anyone who has write permission for the directory where any log files are being written to can append pseudo-arbitrary data to any file on the -system which is writable to the user who starts Apache. Since the +system which is writable by the user who starts Apache. Since the server is normally started by root, you should NOT give anyone write permission to the directory where logs are stored unless you want them to have root access. @@ -95,6 +95,75 @@ Then setup for specific directories

This stops all overrides, Includes and accesses in all directories apart from those named.

+ Protect server files by default +

+One aspect of Apache which is occasionally misunderstood is the feature +of default access. That is, unless you take steps to change it, if the +server can find its way to a file through normal URL mapping rules, it +can serve it to clients. +

+For instance, consider the following example: +

# cd /; ln -s / public_html +
Accessing http://localhost/~root/ +

+This would allow clients to walk through the entire filesystem. To work +around this, add the following block to your server's configuration: +

+ <Directory />
+     Order deny,allow
+     Deny from all
+ </Directory>
+

+This will forbid default access to filesystem locations. Add +appropriate +<Directory> +blocks to allow access only +in those areas you wish. For example, +

+ <Directory /usr/users/*/public_html>
+     Order deny,allow
+     Allow from all
+ </Directory>
+ <Directory /usr/local/httpd>
+     Order deny,allow
+     Allow from all
+ </Directory>
+

+Pay particular attention to the interactions of +<Location> +and +<Directory> +directives; for instance, even if <Directory /> +denies access, a <Location /> directive might +overturn it. +

+Also be wary of playing games with the +UserDir +directive; setting it to something like "./" +would have the same effect, for root, as the first example above. +

Please send any other useful security tips to diff --git a/docs/manual/mod/core.html b/docs/manual/mod/core.html index dea4d54588..6c7cc14dbb 100644 --- a/docs/manual/mod/core.html +++ b/docs/manual/mod/core.html @@ -315,6 +315,30 @@ steps are:

Apply any FileInfo directives in /home/web/.htaccess +

+ +Note that the default Apache access for <Directory /> is +Allow from All. This means that Apache will serve any file +mapped from an URL. It is recommended that you change this with a block +such as + +

+ <Directory />
+     Order Deny,Allow
+     Deny from All
+ </Directory>
+

+ +and then override this for directories you want accessible. +See the +Security Tips +page for more details. + +

+ The directory sections typically occur in the access.conf file, but they may appear in any configuration file. <Directory> directives cannot nest, and cannot appear in a <Limit> section. diff --git a/docs/manual/mod/mod_userdir.html b/docs/manual/mod/mod_userdir.html index 91e996ead0..4511387c80 100644 --- a/docs/manual/mod/mod_userdir.html +++ b/docs/manual/mod/mod_userdir.html @@ -46,6 +46,23 @@ UserDir http://www.foo.com/*/usr -> http://www.foo.com/bob/usr/one/two.html UserDir http://www.foo.com/~*/ -> http://www.foo.com/~bob/one/two.html +

+ +Be careful when using this directive; for instance, "UserDir +./" would map "/~root" to +"/" - which is probably undesirable. See also +the +<Directory> +directive and the +Security Tips +page for more information. + +