Server :: Secure The Directory In Apache?
Sep 24, 2010I created a website in my apache server. I just need to secure that when everyone try to access any folder on my root directory, it will show "Forbidden".
View 3 Replies
ADVERTISEMENT
Ubuntu Security :: Ways To Secure Server Setup With Apache?
Jun 19, 2010I've set up a server for the first time today and I'm reading up on how to secure it. But I was wondering if anyone here would give me some tips from personal experience on what to do before going online with my website for the whole world to see. I'm running Ubuntu Server edition and Apache. Am I good to go with default settings or is there anything recommended that I should first do?
View 9 Replies View RelatedFedora :: Apache Fails To Server Out Directory?
Mar 29, 2011I am having a problem getting Apache to serve out a directory. If I place an index.html in the Document.Root I can see that page. When I remove the index.html I only see the test page for Apache. the relevant section form my httpd.conf. I am not using virtual hosts just setting up one Apache instance.
As you can see from the below I have enabled Indexes so I am at a loss :-(
ServerTokens OS
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 120
KeepAlive Off
MaxKeepAliveRequests 100
[Code]...
Server :: Redirect To Lowercase Directory Apache ?
May 4, 2011just wondering, if i type in a url like this:
how can i get it to direct to:
Server :: View Directory Content In Apache?
Aug 26, 2010I want to view directory content in apache server, for that i configure apache server, but i don't know how to enable autoindxing module, only apache test page is opening when i open my web site.
View 9 Replies View RelatedServer :: Apache - A Default Index.cgi When Directory Is Browsed ?
May 20, 2010I've set up Apache once or twice in the past, but my memory is escaping me on something simple. This time the OS is Cent5 with Apache/2.2.3
When a user browses to: [url] <nothing else> I get as expected, a '403 'You don't have permission to access' because directory browsing is off for obvious reasons :-) If I enter the full URL to the script: [url]it works as expected. No issues there.
What I would *like* to do (and I'm sure I've done this before) is to set the cgi-bin up so if someone leaves off the script name: http://host.name/cgi-bin/ it serves "index.cgi" pretty much in the same way that if you browse to the root http directory, you index.html||php would normally serve. I just can't remember how to achieve this simple thing and I'm starting to wonder 'am I mad? - Did I do this before?'.
Sanity check - index.cgi exists and runs if you call it directly thus:
Code:
I have added:
Code:
That made no difference.
Tried:
Code:
For good measure, but that made no difference - and even
Code:
and no amount of playing with 'Options Indexes || -Indexes || +Indexes' helped me.
Like I say, I'm sure I've done it before (on Debian/Ubuntu) without the need to start playing with redirects or .htaccess - but I'll be blowed if I can remember how.
Server :: How To Get Apache Running In User Home Directory
Dec 10, 2010I'm trying to get Apache to run in a user's home directory. I changed the conf file so that Apache runs under the user and group "kiosk" and changed the DocumentRoot and Directory from the default to "/home/kiosk". Then I set Apache to start at boot (chkconfig --level 235 httpd on) and rebooted. When I checked, httpd is running as kiosk like it should (ps aux | grep httpd). However, when I try wget localhost, I get a 403 response back. If as root I call "httpd -k stop" and then "httpd -k start", then everything works exactly as it should (curiously, if I try using "-k restart", it still doesn't work). After this, httpd still shows as running as kiosk and if I check before calling start, it shows no httpd processes running as expected.
This only happens when I use httpd to stop and then start the web server. If I try to restart using apachectl I still get a 403 error. As an interesting aside, after I've used httpd, if I try using "apachectl restart" I get a "(13)Permission denied: Error retrieving pid file run/httpd.pid" error. This is all on a freshly installed CentOS 5.5 server. Why I'm seeing this very different behaviour from what I thought were just equivalent ways of starting Apache? And then what I could do to get it to start up and run properly on boot? One last item to mention is this isn't a permissions problem. I set the permissions to 777 to both the home and kiosk directories (and 666 to the web files) just to be sure that's not the problem.
Server :: Apache Does Not Have Permission To Modify Files In User Directory - SVN
Mar 30, 2010I recently started using SVN with Apache for my web development, although I find it really annoying that I have to issue two SVN commands (one local, one remote) to update my web site. I have been looking into SVN post-commit hooks to solve this problem. The only problem is that apache does not have permission to modify files in my user directory... So here is how everything is setup. I am running Slackware 13 full install. There have been no installations overriding any of the default installs.
[Code]....
Server :: Rewrite / Redirect Directory To Port Number In Apache?
Jun 4, 2011I have a website example.com, serving pages on port 80. I want the url example.com/redmine to be rewritten to port 3000, where my redmine server is running, without actually changing the URL. So the user typing in example.com/redmine/test would serve up example.com:3000/test, without the user actually connecting through the port. I know this can work through CPanel, but I don't know exactly how it was implemented. I'm looked at how mod_proxy, mod_proxy_html, and mod_rewrite,
View 4 Replies View RelatedCentOS 5 Server :: Apache Mod_security Looking For Atomic Secured Directory?
Mar 6, 2010I wasn't sure if this is the right place to ask or comment on this, but since it's about Apache web server I thought it should work. I finally figured out how to set up and bring up the site using virtual hosts in Apache, though at the moment it's just for my localhost install.
I set them up so I can have a place to play with possible new themes and/or test out the Drupal 7 alpha / beta releases without messing up my current configuration. I decided to look at the error logs for the currently configured site and it had a lot of messages similar to the following:
[Sat Mar 06 09:45:39 2010] [error] [client 127.0.0.1] ModSecurity: Unable to retrieve collection (name "ip", key "127.0.0.1"). Use SecDataDir to define data directory first. [hostname "site.local"] [uri "/"] [unique_id "ZnUHgsCoAAEAABdzR2QAAAAB"]
CentOS 5 Server :: Applying CSS File To Apache Directory Listings
Apr 8, 2011I'm having trouble applying a CSS file to my Apache directory listings. I am running Apache 2.2.3, and have the following lines in my httpd.conf file:IndexOptions FancyIndexing FoldersFirst IconsAreLinks IgnoreCase VersionSort NameWidth=* HTMLTable IndexStyleSheet "css/dir.css"
View 2 Replies View RelatedSecurity :: Granting Apache Sudo Rights Secure?
Sep 27, 2010I have setup a VPS server, created two accounts to two domains respectively, and in one account I built a tool to manage other accounts. I have been rigorously researching and found information, however not implemented yet, about granting apache sudo rights through an interface on one account, so that it can execute scripts as root to manage installations in other accounts. what I mean this is my tool will use 'rsync' to duplicate installations from any account into any account.
My question for security, is it secure to grant apache sudo rights? I have not resolved successfully granting it permissions, and I would not want to waste my time investigating more on it if it can compromise the system in any way.
In your experience, is it feasible to build such a tool like I described? I have the tool working to copy within account and to addon domains and it works great, but I want it to manage all accounts on the server.
OpenSUSE Network :: Setup An Apache Server On Computer Which Will Allow Browsing Of Files In A Specific Directory And Subdirectories?
Jun 13, 2011I'm trying to setup an Apache server on my computer which will allow browsing of files in a specific directory and subdirectories, without needing any sort of authentication.
I've got the Apache2 server up and running through yast, and everything works fine as long as I try to point it to the /www/htdocs folder. However, I want to point it at another folder, which is on another partition. This partition is formatted as NTFS, if that matters at all (here's some background on some permissions issues I had with the NTFS partitions recently).
When I change the "Directory" setting in the Yast http server configuration utility to the directory on the NTFS partition I wish to use, attempting to access the server results in the following error:
Code: Access Forbidden: You don't have permission to access the requested directory. There is either no index document or the directory is read-protected. If you think this is a server error, please contact the webmaster.
Error 403
192.168.1.100
Mon Jun 13 23:43:29 2011
Apache/2.2.17 (Linux/SUSE)
Red Hat :: How To Secure Directory In Web Application?
Aug 27, 2009I have a project in my web server (apache tomcat). I am using red hat. I have flashfiles directory in webapps/myproject/flashfiles. I can possibly access the files in the flashfiles directory as
http://localhot:8080/files/personal.swf
I have to secure the directory by accessing it only within the web application. Please, help me to secure the directory using web server or in red hat.
Security :: Secure CGI File In Apache - Authentication By Entering The Predefined Username And Password
Sep 24, 2010Im using opennms network configuration backup server called 'RANCID'.It run on top of RHEL5 system and using APache. Here's the link which i'm accessing [URL] But any one can access this URL and obtain my configuration files
I want to secure this using a logon page.allow login Only for the successful authentications by entering the predefined username and password But after get authenticate book marking the above URL still can access anyone since it didnt prompt username and password again In eachtime executing the above url it should direct to authenticate page
General :: Access Secure OSX Directory
Dec 20, 2010My better half spilled some coffee on her 8month old macbook and it decided not to work anymore. Apple says it will cost around $800 or more to fix, we wont be paying that, Ill be finding a logic board or service somewhere online now that our warranty is shot and going that route.But before I send the macbook off anywhere I need to pull some data off the HDD. I was able to plug the HDD into my Linux box(internally, I dont have an external enclosure). I was able to mount the drive and copy the directories I wanted to the HDD on my linuxbox.
But Im unable to to access the directory from the terminal or from the file browser, I get an access denied message. Because I know the username and password for the macbook is there a way I can use that to gain access to the directories?Google got me this far, but when I googled "access locked directory ubuntu" or any variation of that with the terms linux and osx thrown in there for good measure.
Ubuntu Servers :: Htaccess Won't Secure A Directory
Nov 22, 2010I installed AWSTATS on my LAMP 10.04 LTS and followed several tutorials URL...) but I can't secure the folder, either by an alias or by .htaccess. I tried both methods manually and by using Webmin.If you go to the URL www.mywebsite/awstats/awstats.pl it shows up, which is good, but this is the default installation site and anyone who knows awstats could possibly see my stats. The conf folder is /etc/awstats/, and I did an alias for that, then .htacess, but neither worked. With the .htaccess, I would get a password promt but the full stats page was visible behind the password promt, and if you clicked "Cancel" about 20 times or so the promt would go away and the full stats page would be visible.
The actual file that powers awstats is in /usr/share/lib/cgi-bin/awstats.pl, and I also tried an Alias and .htaccess seperately and neither worked.I restarted apache2 after each change and I've searched several forums, but I still can't figure this out.
Software :: Secure Authentication Between Active Directory And PHP
Feb 9, 2011My company have an Active Directory to authenticate the user. Now we're implementing a web page in a linux webserver using PHP but one new request is to authenticate the user against AD. The problem is that we need to use SSL or another way to make secure the authentication. We don't know if using openldap and php can do this in a easy way.
View 2 Replies View RelatedCentOS 5 Server :: Username/password On An "aliased Directory" On Apache 2.2.3?
Mar 10, 2010Consider this stanza for a directory on my Apache server:
<Directory "/var/www/html/mine/wedding">
Options FollowSymLinks
Order allow,deny
Allow from all
AuthType Basic
AuthUserFile "/etc/httpd/htpasswd_file"
Require user username
</Directory>
General :: Secure FTP Of A File To The Root Directory On CentOS?
Nov 2, 2010I am running WHM and CPANEL on centos.I would like to upload a file to the root user directory. To be honest, my only experience uploading and downloading files with FTP has been with domain related accounts that were set up under WHM to be managed under CPANEL. This is quite simple, because all you do is set FileZilla or Dreamweaver up with the FTP address of the domain account and the username and password.How can I do something similar to FTP a file into the root or home directory?
View 1 Replies View RelatedRed Hat :: RHEL5 Apache Directory Listing For A Directory?
Feb 1, 2010I have RHEL5 with apache installed and running. I have a directory off of / called software that I would like to have show up as a directory listing so if I go to [URL] I get the directory listing. I have tried searching around and nothing seems to work for me. So out of the box how do I get this to work? My server properly resolves to [URL] so I am good there.
View 8 Replies View RelatedCentOS 5 Server :: Apache 'server-status' 404 Not Found + Munin Apache Stats?
Oct 14, 2010I am trying to solve a problem where Apache stats aren't displaying correctly in Munin. I've ran through quite a bit of checks and tests regarding Munin setup, but I think my issue is related to Apache, but my skill set there is lacking.
first, system info:
monitored server:
CentOS 5.3 2.6.18-128.1.1.el5
[code]....
Ubuntu Servers :: Modern Central User Management - Automount A Secure NFS Share Somewhere In The /home Directory
Mar 14, 2010I've setup Kerberos and OpenLDAP servers (9.10) similar to the official documentation (and other sites that fill in the "gaps"). However, when you start to get in to some of the details, there seem to be many options - and I guess I'm looking for what could be the defacto standard. I'd like to allow Ubuntu clients to have a sso capability, with the ability for local caching of passwords if not connected to the network (such as a laptop user away from the office, prior to a VPN). I'd like to automount a secure NFS share somewhere in the /home directory. If the user logs in to a computer they've not logged in to before (if they're authorized), it would be nice if a skeleton /home directory could be setup there automatically I'm guessing that it is not desirable to use a shared /home NFS - as if you're off the network this would be problematic - as well as multiple computers sharing the same /home. There are some benefits to a shared /home (SSH certs, etc.), so maybe there is a hybrid approach out there.
I've read that it's not necessarily good practice to have OpenLDAP to do the authentication (leave this to Kerberos), but it's fine for authorization (such as ACLs for logins to certain computers). It's also good practice to use TLS with OpenLDAP (which requires public certs on all the clients) and to not allow anonymous read to the directory. I would guess that a computer host keytab could be refreshed to bind to the OpenLDAP server via GSSAPI / SASL to allow a non-anonymous read, and then determine if, say, the user was a member of a group allowed to log in. Kerberos would then pick up and authenticate the user and then proceed to the login. Off the network here, I'm not sure. I found this document, but it's self declared missing items: [URL]
I'll stop the rambling, but I cannot be the only one who would like to setup a relatively standard and secure server based network authentication and authorization back-end. Is there any _complete_ documentation on the best practices and how to implement?
SUSE / Novell :: Clear Apache Cache Without Restarting Apache Server?
Feb 4, 2010Any one have an idea How to clear apache cache without restarting apache server.
View 5 Replies View RelatedServer :: Tunnel Apache Virtual Host To An Internal Apache?
Jan 24, 2010I am upgrading my server and I have a lot of sites. Since I cannot take my server down for a few days, maybe a week until I manage to migrate all the sites to the new machine, I figured I could migrate them one by one. After migrating one, I would somehow tunnel the requests of that name virtual host to my internal machine. When everything is migrated, I would then switch the machines, update ip's and stuff and everything will work just fine.
However I cannot seem to find a way to do this tunneling. is this at all possible? If not, what alternatives do I have?
Security :: Ways To Secure Sendmail Or Secure Alternatives To Send Mail
Dec 1, 2010I'm an Oracle DBA and started working for my current employer about 4 months ago. This past weekend an alert re: FS space brought my attention to /var/spool/clientmqueue (full of mail re: cron jobs) and the fact that sendmail is not running on our Linux servers.I'm told that the IT security team deemed sendmail too vulnerable so we don't run it.Aside from FS filling up and missing notification of issues with crontab entries, I'm concerned that we may be missing notification of potential issues. In other Unix/Linux environments I've seen emails from the print daemon when it experienced problems with specific jobs.
Are there other Linux facilities aside from cron and lpd that use email to advise the users of possible issues? Are there ways to secure sendmail or secure alternatives to sendmail? My primary need/desire is to make sure that emails regarding issues on the server get to the appropriate users. Secondary goal would be to have the ability to use mailx to send mail out. There is No need/desire to receive mail from outside.
Server :: Secure Remote Server From Unwanted Ssh Logins?
Jul 2, 2010we have a remote linux server and its /var/log/secureile is fully filled with unauthorized ssh users,of course they cannot able to log in successfully but they were making continuous ssh requests to log in, it some times results in server down problem. so how to secure our server from their ssh attempts.i know blocking unauthorized ip addresses can solve this problem and we can also change the ssh port numbers but what are the other possible ways of solving this.
View 4 Replies View RelatedSecurity :: Secure FTP - Root Privileges After Logging In Form A Macintosh And Could Browse The Root Directory
Apr 12, 2010I run ProFTPd with TLS authentication on my Debian Lenny server. My problem is that despite of the fact that my users connect chrooted, one of my friends had root privileges after logging in form a Macintosh and could browse the root directory, too.
View 1 Replies View RelatedServer :: How To Know If My Box Is Secure
Apr 16, 2011I now have a windows box connected to the internet via the server.
Question is - how do I know if the linux box is secure?
Are there any things that I have to config now - I am slowly moving on to configuring the dns and dhcp server - but is there anything else I should have done?
General :: Put A '/' In The Directory Path With Apache?
Nov 8, 2010I am using Apache/2.2.3 on Centos 55. I am having an issue that is pretty strange to me. Whenever I navigate to a url on my webserver from outside my network. I have to put a '/' in the directory path for example When I type in: mydomain.com/directory1 it winds up redirecting to the hostname for my server HOWEVER When I type in mydomain.com/directory1/ it works, since I am adding the '/' at the end of the path. I suspect it is because I do not have my FQDN set up correctly.I did not have this issue when I was using Ubuntu 10.04 , I suspect because Ubuntu automagically set this up for me. Is there a particular way I need to setup my FQDN in centos to get this to work properly? I have tried going into /etc/hosts and adding my FQDN in there, but I do not think I did it properly, is there a particular way the /etc/hosts file needs to be setup?
View 1 Replies View Related