|
Home > Archive > Web Servers on Windows > September 2004 > Apache 2, Win XP Pro SP2, directory security over web...how?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Apache 2, Win XP Pro SP2, directory security over web...how?
|
|
| Haywood Jaablowme 2004-09-02, 6:14 pm |
| Hello, I'm running Apache 2 with php 5 on my windows XP. Everything
is running just fine so far, but I'd like to implement better security
on my server. For example, I am running a preprogrammed php script on
one of my subdomains. The script has its own include directory. I do
not want to have to move the include directory and go and change all
the php scripts so that they work with the change. Instead, what I
would like is to be able to configure Apache so that only the server
itself has rights to that include directory (and sub directories &
files).
http://blog.domain.com/ is ok to be initially accessed by visitors
but
http://blog.domain.com/includes/ should return a 401 or 403 error
YET the server itself should be able to call on this directory, sub
directories, and their files without any problems.
So if http://blog.domain.com/index.php uses another file or image from
within http://blog.domain.com/includes/ there shouldnt be any
problems, everything should go as planned, but if a visitor actually
directs their browser to a file or image, they'll receive an error.
http://blog.domain.com/includes/images/image.gif should return 401 or
403 for people who try to browse to it directly, but
http://blog.domain.com/index.php can use it without any problems.
I have tried to change the access on the include directory, but when I
do that, the server itself wont display the images or use the files
either.
the following is what I have on my httpd.conf file
--------------------------------------------------------------------------------
NameVirtualHost my.server.ip.address
<Directory "F:/Apache2/htdocs">
Options -Indexes FollowSymLinks
IndexIgnore *
AllowOverride None
Order Allow,Deny
Deny from all
Allow from my.server.ip.address
</Directory>
<Directory "F:/Apache2/htdocs/includes">
Options -Indexes -FollowSymLinks +SymLinksIfOwnerMatch
IndexIgnore *
AllowOverride None
Order Deny,Allow
Deny from all
Allow from my.server.ip.address
</Directory>
<Directory "F:/Apache2/htdocs/www">
IndexIgnore *
AllowOverride None
Order Allow,Deny
Allow from all
</Directory>
<VirtualHost my.server.ip.address>
ServerName www.domain.com
DocumentRoot F:/Apache2/htdocs/www
ServerAlias www
</VirtualHost>
<Directory "F:/Apache2/htdocs/blog">
IndexIgnore *
AllowOverride None
Order Allow,Deny
Allow from all
</Directory>
<VirtualHost my.server.ip.address>
ServerName blog.domain.com
DocumentRoot F:/Apache2/htdocs/blog
ServerAlias blog
</VirtualHost>
<Directory "F:/Apache2/htdocs/blog/*">
Options -Indexes -FollowSymLinks +SymLinksIfOwnerMatch
IndexIgnore *
AllowOverride None
# Order Deny,Allow
# Deny from all
# Allow from my.server.ip.address
</Directory>
--------------------------------------------------------------------------------
I created my own includes folder to be used on my server at
/htdocs/includes and set permissions for it (havent tested it yet),
but the includes folders in question here are at /htdocs/blog/inc
/htdocs/blog/images etc etc
What am I doing wrong here? Please help!
I'm not sure if I signed up for this mail group correctly, so please
send replies to haywood.jaablowme@gmail.com
thanks.
|
|
|
|
|