Chris Tyler - Fedora Linux

ServerAdministrator webmaster@fedorabook.com

The IP address and port are configured with the Listen directive. The web server will normally listen to port 80 on all available network interfaces:

Listen 80

If necessary, you can specify an alternate port, or a specific IP address and a port:

Listen 8000

Listen 192.168.10.1:8000

The ServerName directive configures the name of the server and is necessary only if you are using a value different from the machine's fully qualified domain name:

ServerName www.fedorabook.com

Apache uses directory containers to control access to directories on your system. The root directory is configured first:

Options FollowSymLinks

AllowOverride None

The Options directive is critical: it specifies what is permitted in these directories. In this case, all access to the root directory and all subdirectoriesin other words, the entire systemis prohibited except as the destination of symbolic links.

The next directory container loosens up the restrictions for /var/www/html and its subdirectories:

Options Indexes FollowSymLinks

AllowOverride None

Order Allow,Deny

Allow from all

The values for the Options directive are selected from this list:

All

The default, which permits everything except for MultiViews .

ExecCGI

Permits execution of scripts.

FollowSymLinks , SymLinksIfOwnerMatch

If FollowSynLinks is specified Apache will follow symbolic links which lead to or from this directory. If SymLinksIfOwnerMatch is specified, the link and the target must be owned by the same user.

Includes , IncludesNoExec

Files may include other files, with or without the ability ( Includes and IncludesNoExec , respectively) to execute those other files. Files that use this feature must have a name ending in .shtml and may include directives such as or to include the footer.html file or the output of the cal command, respectively.

Indexes

An index.html file usually serves as the index for a directory. If it is not present, and the Indexes option is enabled, Apache will generate an appropriate index page when required, listing the contents of the directory. If you do not wish your web visitor to know the contents of your directories, do not use this option.

MultiViews

Enables Apache to search for appropriate content based on file type, encoding, and language. For example, if the MultiViews option is in effect, Apache will select between index.html.en (English) and index.html.fr (French) files when index.html is requested, using the browser's language preference to select the most appropriate file.

Order , Allow , and Deny are directives that work together to define which remote users may access the directory. Order sets the order in which the Allow and Deny directives are used, and the value must be Allow,Deny or Deny,Allow (the default). The Allow and Deny directives accept a list of full or partial domain names, IP addresses, or IP addresses and netmask or network bit count.

For example, to enable access only from computers on your internal network, assuming your network is 12.200.X.X :

Order Allow,Deny

Allow from 12.200.0.0/16

Deny from all

On the other hand, you could enable access only from computers that are not in your internal network:

Order Deny,Allow

Deny from 12.200.0.0/255.255.0.0

Allow from all

Or you could exclude access from specific domains:

Order Deny,Allow

Deny from .gov ourcompetition.com

Allow from all

The AllowOverride directive enables the use of a hidden file, .htaccess , which may be placed in directories to override the configuration of that directory and subdirectories. Although there are several possible values for this directive, it is normally set to None (no overrides are permitted) or AuthConfig (the .htaccess file can control whether a user ID and password are required to access the content of that directory).

The next set of directory containers configure special permissions for the icon , cgi-bin , and error directories in /var/www :

Options Indexes MultiViews

AllowOverride None

Order Allow,Deny

Allow from all

AllowOverride None

Options None

Order Allow,Deny

Allow from all

AllowOverride None

Options IncludesNoExec

AddOutputFilter Includes html

AddHandler type-map var

Order Allow,Deny

Allow from all

LanguagePriority en es de fr

ForceLanguagePriority Prefer Fallback

These directories are not within the normal DocumentRoot and are instead made accessible through the use of Alias and ScriptAlias directives:

Alias /icons/ "/var/www/icons/"

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

Alias /error/ "/var/www/error/"

These directives make the indicated directories appear to exist within the document tree; for example, a request for http:///icons/text.png is fulfilled using the file /var/www/icons/text.png (instead of /var/www/html/icons/text.png ). This permits /var/www/html to remain uncluttered by icons, scripts, and error messages.

Since /cgi-bin/ is aliased using a ScriptAlias directive, it is assumed that all files in that directory are actually scripts (executable programs) rather than document files, regardless of their extension. In the default configuration, this is the only directory that may contain scripts, so you only have to look in one place to check for script vulnerabilities.

To permit each user to maintain her own web directory, find the UserDir section of httpd.conf:

#

# UserDir is disabled by default since it can confirm the presence

# of a username on the system (depending on home directory

# permissions).

#

UserDir disable

#

# To enable requests to /~user/ to serve the user's public_html

# directory, remove the "UserDir disable" line above, and uncomment

# the following line instead:

#

#UserDir public_html

Comment out the line that reads UserDir disable and uncomment the line which reads UserDir public_html :

#

# UserDir is disabled by default since it can confirm the presence

# of a username on the system (depending on home directory

# permissions).

#

#UserDir disable

#

# To enable requests to /~user/ to serve the user's public_html

# directory, remove the "UserDir disable" line above, and uncomment

# the following line instead:

#

UserDir public_html

Then uncomment the container section :

#

# Control access to UserDir directories. The following is an example