--- Begin Message ---
- To: submit@bugs.debian.org
- Subject: httpd.conf: Files default directive should deny more odd filenames
- From: Stephen Gildea <gildea@stop.mail-abuse.org>
- Date: Thu, 21 Jul 2005 11:54:16 -0700
- Message-id: <20050721185416.DA2DE3CC00E@tigger.sf.gildea.net>
Package: apache-common
Version: 1.3.33-6
Tags: patch
The default Debian /etc/apache/httpd.conf uses a Files directive to deny
access to .htaccess files. But there are many other filename patterns
that, should they be found in the web tree, should also be denied.
The Files directive currently looks like this:
<Files ~ "^\.ht">
Order allow,deny
Deny from all
</Files>
The appended patch changes the first line to this:
<Files ~ "^\.|^_|RCS|CVS|,|~|#">
Here's what the new patterns are intended to match:
.* is for .htaccess, .htpasswd, .svn, Emacs locks, etc.
_* is for _vti_* and other FrontPage files.
, is for RCS files and some backup files.
~ is for Emacs backup files.
# is for Emacs lock files and backup files.
Now you may say that all the patterns added by this patch match files
that do not need to be under the web document root and therefore
shouldn't be. However, I'm sure we've all seen the misconfigured sites
and packages that install extraneous files in the web tree. The default
Apache configuration should protect sites from such mistakes. (And in
the unlikely event that someone intends some such oddly-named file to be
served, they can change http.conf.)
This same suggestion applies to apache2.conf in apache2-common 2.0.54-4.
< Stephen
--- apache-1.3.33/debian/pkgtemplates/flavours.httpd.conf 2005-06-28 23:48:15.000000000 -0700
+++ debian/pkgtemplates/flavours.httpd.conf 2005-06-29 00:56:26.000000000 -0700
@@ -395,17 +395,25 @@
AccessFileName .htaccess
#
-# The following lines prevent .htaccess files from being viewed by
-# Web clients. Since .htaccess files often contain authorization
-# information, access is disallowed for security reasons. Comment
-# these lines out if you want Web visitors to see the contents of
-# .htaccess files. If you change the AccessFileName directive above,
-# be sure to make the corresponding changes here.
+# The following lines prevent Web clients from viewing .htaccess files
+# and other "control" files that are probably not part of the intended
+# web content. (Comment these lines out if you want Web visitors to
+# see the contents of .htaccess files or other matching files.) If
+# you change the AccessFileName directive above, be sure to make any
+# necessary corresponding change here.
+#
+# This directive also denies access to files that look like they might
+# be unintentional if they are found under the DocumentRoot. These
+# files probably shouldn't be under the DocumentRoot at all, but many
+# sites are mis-configured, so include them in the default deny pattern.
+#
+# .* catches .htaccess, .htpasswd, .svn, Emacs locks, etc.
+# _* catches _vti_* and other FrontPage files.
+# , catches RCS files and some backup files.
+# ~ catches Emacs backup files.
+# # catches Emacs lock files and backup files.
#
-# Also, folks tend to use names such as .htpasswd for password
-# files, so this will protect those as well.
-#
-<Files ~ "^\.ht">
+<Files ~ "^\.|^_|RCS|CVS|,|~|#">
Order allow,deny
Deny from all
</Files>
--- End Message ---