On Mon, 10 Sep 2001, Christian Westphal wrote:

Try to set AllowOverride All In the httpd.conf I did AllowOverride All </Directory>

my .htaccess is below /mydir ... it still doesn't work :( -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus@gaugusch.dhs.org X Against HTML Mail / \

There is another AllowOverride in the server-wide configuration. That one also has to be set to All. thank you, now I got it, I set (note the full path) AllowOverride All </Directory>

Dear suse-people, I think it is a bad default to ignore .htaccess in the web tree, as it brings more problems, than it may prevent (IMHO). Will this default change in the next SuSE release? thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus@gaugusch.dhs.org X Against HTML Mail / \

Ermmm... enabling things like authconfig override by default makes for all sorts of potential problems/weirdness. If someone wants to use authconfig and can't be bothered to enable it they probably won't be using it correctly anyways. Sticking in some examples and commenting them out is probably sufficient. yes, after a little bit of thinking, this is better. An entry in the SDB would also be cool. I'm no apache expert, but it just makes me crazy, that .htaccess is just ignored for (apparently) no reason. Especially, because the directory really needs protection ...

But now it's fine :) thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus@gaugusch.dhs.org X Against HTML Mail / \

..or not in german: http://sdb.suse.de/en/sdb/html/daniel_mod_auth_nds.html ;-)) Eicke Kemm wrote:

maybe this solves the problem:

http://sdb.suse.de/de/sdb/html/daniel_mod_auth_nds.html

It's not holes per se, but it could be unexpected. Many sites do NOT want to grant their users the ability to use .htaccess files (increased overhead for example). Kurt Seifried, kurt@seifried.org PGP Key ID: 0xAD56E574 Fingerprint: A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/ ----- Original Message ----- From: "Christian Westphal" To: "'SuSE-Security'" Cc: "'Kurt Seifried'" Sent: Monday, September 10, 2001 5:24 AM Subject: AW: [suse-security] Apache on SuSE 7.2 and .htaccess

...

Ermmm... enabling things like authconfig override by default makes for all sorts of potential problems/weirdness. If someone wants to use authconfig and can't be bothered to enable it they probably won't be using it correctly anyways. Sticking in some examples and commenting them out is probably sufficient.

Hm, you will be right...

Actually, I don't see real security holes in enabling it by default. Something I missed?

Thanks a lot!

Chris

From my www-auth paper (http://www.seifried.org/security/www-auth/):

Apache supports a wide variety of authentication methods, several of which can be considered "standard" and are typically included in vendor packages of Apache. You can assign security to files and directories with Apache, the configuration for this is either done in the central httpd.conf file or in the defined "AccessFileName". For example to make ".htaccess" files your access file you would add the following to httpd.conf: AccessFileName .htaccess And in order to prevent people from downloading these files you would add the following to your httpd.conf: Order allow,deny Deny from all </Files> This means that any file starting with ".ht" (i.e. .htaccess, .htpasswd, .htgroup, .htfoobar) will not be sent if a client requests it. You will then need to configure Apache to allow for specific features, using the "AllowOverride" directive within a " configuration section. Typically the safest thing to do is define a "<Directory />" that disables everything and then enable features as needed on a per directory basis. For example to allow .htaccess files in /var/www/secure-area: AllowOverride AuthConfig Order allow,deny Allow from all </Directory> If your .htaccess file does not work and "AccessFileName" is defined then this is probably the problem. Kurt Seifried, kurt@seifried.org PGP Key ID: 0xAD56E574 Fingerprint: A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/