Extra configuration for security?

[Guille -bisho- <bi...@eurielec.etsit.upm.es>]

It may be interesting to add some extra configuration for added security. We
currently have in the httpd.conf the following:

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

It's very interesting to add:

<Files ~ "(~|.swp|.inc|.conf|.bak|.old|.kk)$">
    Order deny,allow
    Deny from all
</Files>

Also there are some cases in which you update a module, like php, and it
result broken. In those cases the IfModule that makes the .php scripts
parseable fails, and all the php code is directly readable.

This config could help in those cases:

<IfModule !mod_php4.c>
<Files ~ ".php$">
    Order deny,allow
    Deny from all
</Files>
</IfModule>

That's all. Maybe it's interesting adding it to the default config.

See you!

-- 
        _     Guillermo Pérez    -=] 11/02/2002 [=-
       <·)     - bisho@ ( onirica.com | eurielec.etsit.upm.es )
       ( \>
bisho!  ""\\  ::              Say NO! to RAND W3 Patents              ::

Re: Extra configuration for security?

[Rodent of Unusual Size <Ke...@Golux.Com>]

Guille -bisho- wrote:
> 
> <Files ~ "^\.ht">
>     Order allow,deny
>     Deny from all
> </Files>
> 
> It's very interesting to add:
> 
> <Files ~ "(~|.swp|.inc|.conf|.bak|.old|.kk)$">
>     Order deny,allow
>     Deny from all
> </Files>

Why are you reversing the order from 'allow,deny' to 'deny,allow'?
The former is more restrictive and I think should be kept.

Otherwise, looks like a good idea to me.  (And for anyone
who suggests we shouldn't special-case PHP, just remember
that it's an ASF project -- so maybe we should add code like this
for the others, as well [e.g., mod_dtcl].)
-- 
#ken	P-)}

Ken Coar, Sanagendamgagwedweinini  http://Golux.Com/coar/
Author, developer, opinionist      http://Apache-Server.Com/

"Millennium hand and shrimp!"