- Joined
- Feb 27, 2003
- Messages
- 8,525
Update:
A patch can now be used instead of the httpd.conf files changes, and is the recommended method.
Use the harden-symlinks-patch option instead of secure_htaccess.
Related knowledgebase entry:
http://help.directadmin.com/item.php?id=421
--------------------------------
Hello,
It's been discovered that it's more secure not to allow the FollowSymLinks option in apache. The only way to truly disable that item is to change the AllowOverride settings in the main httpd.conf. Without the change of the AllowOverride, anyone could simply re-enable in an .htaccess file.
The catch with this change, is that any sites that currently have:
will throw an 500 Internal Server Error. The apache error log entry would look like:
which would signify that the .htaccess has the FollowSymLinks option, which is no longer allowed to be used.
Since this change as the potential to break existing sites, we will not enable it for existing installs. However, new installs will have this option enabled.
The option is in the custombuild options.conf and is
which, when set and you run
you'll end up with a httpd-directories.conf symbolic link in /etc/httpd/conf/extra/httpd-directories-new.conf. When set to "no", it will link to httpd-directories-old.conf, which contain the old method of setting up the AllowOverride for the <Directory ..>
Versions entry:
http://www.directadmin.com/features.php?id=1119
John
A patch can now be used instead of the httpd.conf files changes, and is the recommended method.
Use the harden-symlinks-patch option instead of secure_htaccess.
Code:
cd /usr/local/directadmin/custombuild
./build update
./build set harden-symlinks-patch yes
./build set secure_htaccess no
./build apache
./build rewrite_confs
http://help.directadmin.com/item.php?id=421
--------------------------------
Hello,
It's been discovered that it's more secure not to allow the FollowSymLinks option in apache. The only way to truly disable that item is to change the AllowOverride settings in the main httpd.conf. Without the change of the AllowOverride, anyone could simply re-enable in an .htaccess file.
The catch with this change, is that any sites that currently have:
Code:
Options FollowSymLinks
Code:
[Thu Dec 08 03:25:56 2011] [alert] [client 1.2.3.4] /home/[b]username[/b]/domains/[b]domain.com[/b]/public_html/.htaccess: Option FollowSymLinks not allowed here
Since this change as the potential to break existing sites, we will not enable it for existing installs. However, new installs will have this option enabled.
The option is in the custombuild options.conf and is
Code:
secure_htaccess=yes
Code:
./build update
./build set secure_htaccess yes
./build rewrite_confs
Versions entry:
http://www.directadmin.com/features.php?id=1119
John