Solved

Apache .htaccess not working

Posted on 2012-12-26
7
435 Views
Last Modified: 2013-04-01
Hello,  I created a htaccess and passed it at the root of the html directory.  I even set it so that apache is the owner of the file.  However, I am still able to hotlink to my image or pdf file.  What could be the problem?  Please see my htaccess file below.

Thanks for your assistance.

#prevent viewing of .htaccess file
<Files .htaccess>
order allow,deny
deny from all
</Files>

#prevent directory listing
IndexIgnore *

#custom error message
ErrorDocument 401 /custom-error/401.php
ErrorDocument 403 /custom-error/403.php
ErrorDocument 404 /custom-error/404.php
ErrorDocument 500 /custom-error/500.php

#prevent hotlinking to images (gif, png, jpg), documents (csv, pdf, xls, xlsx) and web files (javascript: js, css)
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|png|jpg|csv|pdf|xls|xlsx|js|css)$ - [F]
0
Comment
Question by:lgduong
7 Comments
 
LVL 109

Accepted Solution

by:
Ray Paseur earned 300 total points
ID: 38721889
You may get a good answer on the Apache front, but in case you do not, or you want a little stronger way to discourage hotlinking, this article will show how to watermark hotlinked image files.  If the watermark is not enough for you, you could change the script a very little bit and render a picture of something else that would discourage further hotlinking...
www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_10065.html
0
 
LVL 26

Expert Comment

by:arober11
ID: 38723847
If you have root access, put the above block in the httpd.conf, as Apache will only have to parse and compile the rules once, at server start-up, rather than for every browser request received by Apache.

As to why it dosen't work, loose the first Http_referer condition, as that's allowing BLANK referer strings.
0
 
LVL 9

Expert Comment

by:abolinhas
ID: 38727655
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:lgduong
ID: 38745419
abolinhas -- i tried that and the code look the same to me.

arober11 - i don't think it is i the http_referer condition.  it is recommending to have the blank refere string and i do want that as part of the condition

ray_paseur - that is a good idea if images and other files aren't changing as often as it is here.

I am still hoping to use htaccess so that I have control over security instead of having to rely on system admin because they are the only one who can configure the httpd.conf file.

Does anyone else see or know why my code might not be working??
0
 
LVL 26

Expert Comment

by:arober11
ID: 38769166
If you want to see what's going on, have the admin temporarily paste the following into you httpd.conf  and restart Apache:

RewriteLog  /tmp/tmp_apace_rewrite.log
RewtiteLogLevel 9

Open in new window

0
 

Author Comment

by:lgduong
ID: 38835375
arober11 - I have the admin perform the modification to the httpd.conf and when I viewed the log file, I get the following:

 (2) init rewrite engine with requested uri /
 (3) applying pattern '^(/htdocs/.*)' to uri '/'
 (3) applying pattern '.*' to uri '/'
 (4) RewriteCond: input='GET' pattern='^(TRACE|TRACK)' => not-matched
 (1) pass through /
 (3) [perdir /var/www/html/] strip per-dir prefix: /var/www/html/ ->
 (3) [perdir /var/www/html/] applying pattern '\.(gif|png|jpg|csv|pdf|xls|xlsx|js|css)$' to uri ''
 (1) [perdir /var/www/html/] pass through /var/www/html

Does the log indicates what the problem might be?
0
 
LVL 26

Expert Comment

by:arober11
ID: 38962288
Nope, you've cut off the URI from the rules, was expecting output in the following format:

(3) [perdir  /var/www/html/] applying pattern '\.(js|ico|gif|jpg|png|css)$' to uri 'index.php'

So the output above is of little use, other than to prove the rule is in place and being invoked.
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you've heard about htaccess and it sounds like it does what you want, but you're not sure how it works... well, you're in the right place. Read on. Some Basics #1. It's a file and its filename is .htaccess (yes, with a dot in the front). #…
When it comes to showing a 404 error page to your visitors, you do not want that generic page to show, and you especially do not want your hosting provider’s ad error page to show either. In this article, I will show you how to enable the custom 40…
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question