Solved

Setting Apache Security

Posted on 2002-03-05
11
228 Views
Last Modified: 2010-03-04
I'm now using Apache as my sever running on linux..
I don't wanna let others to access the files stored on Apache....
Eg...one can access the files inside test folder using the following link:
174.75.84.32/test/  
how can I prevent others from accessing the files using the method mentioned above?
0
Comment
Question by:usher
  • 4
  • 2
  • 2
  • +1
11 Comments
 
LVL 1

Accepted Solution

by:
johnnyp earned 25 total points
Comment Utility
You can restrict access to your website and any virtual sites on it through the httpd.conf file.

In the global config, within the <Directory> tags for the default DocumentRoot there is an allow,deny section: where you can configure access for individual IP's, hostnames, subnets or domains.

If you simply want to deny access to the /test/ directory, you can configure security through .htaccess files.

Can you be a little more specific with what you want to deny access to, the whole website or just trees from the top level?  Once you let me know, I can go into a little more detail.

0
 

Author Comment

by:usher
Comment Utility
Actually I intend to set security so that no one can access our sever and steal files from it...

0
 
LVL 1

Expert Comment

by:johnnyp
Comment Utility
So we are talking purely from a filesystem point of view.  At which point you can use a filewall solution which is shipped with most Linux versions.  RedHat comes with IPCHAINS.

Slightly less intense than a firewall would be to use TPC Wrappers in which you can configure specific inetd or xinetd available daemons to be accessible from selected hosts or domains as I stated in my previous post.

If this is the sort of thing your looking for?
0
 

Author Comment

by:usher
Comment Utility
Actually I'm not that familiar with Apache
I have a folder stored under this directory:
apache_1.3.22\htdocs\interface

How can I set things in order to protect the files "interface" under this directory?

0
 

Assisted Solution

by:tommyh
tommyh earned 25 total points
Comment Utility
create a .htaccess file and put in the directory you wish to protect, it should contain something like;

AuthUserFile </path/.htpasswd>
AuthGroupFile /dev/null
AuthName "Not worth looking at really, so go away"
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>

where you should replace </path/.htpasswd> with a full path to a folder outside your webroot.

and then cd to the directory you specified in </path/.htpasswd> and run;
htpasswd -c .htpasswd <username> <password>

where username and password are replaced with something suitable, and hey presto, that folder should request a username and password for users browsing items in the folder.



0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:usher
Comment Utility
Some told me that that's a file storing all the config files for apache...
Do u know where and what's the name of that file?
Btw, would you mind telling me which config file I should change so that the server will send an email automatically to administrator in case the server has problem?
0
 

Expert Comment

by:tommyh
Comment Utility
the httpd.conf file can be in various places.

/etc/httpd/conf/httpd.conf

is where it is on my linux box,

also you will need to restart httpd if you make any changes.

service httpd restart

or sometimes

apachectl restart



0
 

Author Comment

by:usher
Comment Utility
How about if I would like to achieve the followings:
When I go to eg http://192.45.23.52/interface/
it will display all the files containing in the interface folder....how could I change the setting so that when people access this link http://192.45.23.52/interface/
it will prompt to a error page instead of allowing people view the files?
0
 
LVL 15

Assisted Solution

by:samri
samri earned 25 total points
Comment Utility
usher,

By default apache will deny directory listing (At least on 1.3.22 RH7.2).  One option to deny Directory listing is to create an index.html file (or whatever filel defined in DirectoryIndex directive)

a index.html will the following content would do.
----------
<html>
<head>
</head>

<body></body>
</html
----------
0
 
LVL 15

Expert Comment

by:samri
Comment Utility
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

As Wikipedia explains 'robots.txt' as -- the robot exclusion standard, also known as the Robots Exclusion Protocol or robots.txt protocol, is a convention to prevent cooperating web spiders and other web robots from accessing all or part of a websit…
Hi, in this article I'm going to teach you how to run your own site, and how to let people in (without IP). I'll talk about and explain each step... :) By the way, everything in this Tutorial is completely free and legal. This article is for …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now