You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Paul Smith <pa...@pscs.co.uk> on 2003/03/19 18:30:28 UTC
[users@httpd] Security & Case sensitivity in Windows
I've got Apache 1.3.26 for Win32 (yes, I know I should upgrade to 1.3.27..)
Trying to limit access to certain URIs I have a configuration like this:
<VirtualHost 1.2.3.4:80>
ServerName mysite.co.uk
#blah blah
<Location /admin/>
order deny,allow
deny from all
allow from 192.168.1.1
</Location>
</VirtualHost
On the face of it this should restrict access to the
'mysite.co.uk/admin/...' directory
In fact, it DOES restrict access to that folder, BUT it does NOT restrict
access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
but not on Windows ones, where /admin/ and /Admin/ are the same.
So:
- is there a way to make Apache not case sensitive when checking
Location/LocationMatch directives
- would upgrading to 2.0.44 solve the problem (I can't see anything obvious
in the change log, but case insensitivity may have slipped in anyway)
- or have I found a new problem....
Suggestions?
Paul VPOP3 - Internet Email Server/Gateway
support@pscs.co.uk http://www.pscs.co.uk/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Security & Case sensitivity in Windows
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
At 08:49 PM 3/19/2003, Joshua Slive wrote:
>On Wed, 19 Mar 2003, Paul Smith wrote:
>
>>
>> > > In fact, it DOES restrict access to that folder, BUT it does NOT restrict
>> > > access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
>> > > but not on Windows ones, where /admin/ and /Admin/ are the same.
>> >
>> >This fact is well document at (for example):
>> >http://httpd.apache.org/docs-2.0/sections.html#file-and-web
>>
>> Thanks :-)
>>
>> I spent about 20 minutes looking on the apache website for something to do
>> with this, but I couldn't find it - maybe the <location> part of the online
>> docs should mention this (I'd assumed that Directory had the same problem)
>
>I don't disagree. That fact (<Location> shouldn't be used to
>restrict filesystem directories) should probably be explicitly mentioned
>explicitly in the docs for <Location>, rather than just by reference to
>the sections.html doc.
++1 and then some! Always good to learn which sections have mislead
users to the wrong config - and then fix those sections :-)
Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
Re: [users@httpd] Security & Case sensitivity in Windows
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
At 08:49 PM 3/19/2003, Joshua Slive wrote:
>On Wed, 19 Mar 2003, Paul Smith wrote:
>
>>
>> > > In fact, it DOES restrict access to that folder, BUT it does NOT restrict
>> > > access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
>> > > but not on Windows ones, where /admin/ and /Admin/ are the same.
>> >
>> >This fact is well document at (for example):
>> >http://httpd.apache.org/docs-2.0/sections.html#file-and-web
>>
>> Thanks :-)
>>
>> I spent about 20 minutes looking on the apache website for something to do
>> with this, but I couldn't find it - maybe the <location> part of the online
>> docs should mention this (I'd assumed that Directory had the same problem)
>
>I don't disagree. That fact (<Location> shouldn't be used to
>restrict filesystem directories) should probably be explicitly mentioned
>explicitly in the docs for <Location>, rather than just by reference to
>the sections.html doc.
++1 and then some! Always good to learn which sections have mislead
users to the wrong config - and then fix those sections :-)
Bill
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Security & Case sensitivity in Windows
Posted by Joshua Slive <jo...@slive.ca>.
On Wed, 19 Mar 2003, Paul Smith wrote:
>
> > > In fact, it DOES restrict access to that folder, BUT it does NOT restrict
> > > access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
> > > but not on Windows ones, where /admin/ and /Admin/ are the same.
> >
> >This fact is well document at (for example):
> >http://httpd.apache.org/docs-2.0/sections.html#file-and-web
>
> Thanks :-)
>
> I spent about 20 minutes looking on the apache website for something to do
> with this, but I couldn't find it - maybe the <location> part of the online
> docs should mention this (I'd assumed that Directory had the same problem)
I don't disagree. That fact (<Location> shouldn't be used to
restrict filesystem directories) should probably be explicitly mentioned
explicitly in the docs for <Location>, rather than just by reference to
the sections.html doc.
Joshua.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
Re: [users@httpd] Security & Case sensitivity in Windows
Posted by Joshua Slive <jo...@slive.ca>.
On Wed, 19 Mar 2003, Paul Smith wrote:
>
> > > In fact, it DOES restrict access to that folder, BUT it does NOT restrict
> > > access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
> > > but not on Windows ones, where /admin/ and /Admin/ are the same.
> >
> >This fact is well document at (for example):
> >http://httpd.apache.org/docs-2.0/sections.html#file-and-web
>
> Thanks :-)
>
> I spent about 20 minutes looking on the apache website for something to do
> with this, but I couldn't find it - maybe the <location> part of the online
> docs should mention this (I'd assumed that Directory had the same problem)
I don't disagree. That fact (<Location> shouldn't be used to
restrict filesystem directories) should probably be explicitly mentioned
explicitly in the docs for <Location>, rather than just by reference to
the sections.html doc.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Security & Case sensitivity in Windows
Posted by Paul Smith <pa...@pscs.co.uk>.
> > In fact, it DOES restrict access to that folder, BUT it does NOT restrict
> > access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
> > but not on Windows ones, where /admin/ and /Admin/ are the same.
>
>This fact is well document at (for example):
>http://httpd.apache.org/docs-2.0/sections.html#file-and-web
Thanks :-)
I spent about 20 minutes looking on the apache website for something to do
with this, but I couldn't find it - maybe the <location> part of the online
docs should mention this (I'd assumed that Directory had the same problem)
Paul VPOP3 - Internet Email Server/Gateway
support@pscs.co.uk http://www.pscs.co.uk/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Security & Case sensitivity in Windows
Posted by Joshua Slive <jo...@slive.ca>.
On Wed, 19 Mar 2003, Paul Smith wrote:
> Trying to limit access to certain URIs I have a configuration like this:
> <Location /admin/>
> order deny,allow
> deny from all
> allow from 192.168.1.1
> </Location>
> In fact, it DOES restrict access to that folder, BUT it does NOT restrict
> access to 'mysite.co.uk/Admin/...' This would be fine on Unix file systems,
> but not on Windows ones, where /admin/ and /Admin/ are the same.
This fact is well document at (for example):
http://httpd.apache.org/docs-2.0/sections.html#file-and-web
When protecting file-system locations, always use <Directory>, not
<Location>. <Location> should only be used to protect resources that do
not exist in the filesystem. This is true regardless of whether you use
unix or windows, since there are many ways that a single filesystem
location could map to several different URLs.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org