Index of /... to "Access denied" >> Permissions

[LocoPollo]

I have made a little perl script that creates some folders (and files). It creates the folders as owner 'www' (not as my ordinary username 'hotguy' - and I guess 'apache' is set to '

http://www')

The permissions are chmod to '0700' (I only want my scripts to be able to see what is in the folders - I have made a little login/password thingy)

However when I enter the URL for the folders in a browser, then I get a complete list of the folder that has been created!? that wasn't the meaning, it should be secret! maybe get a "Access denied" thingy or something.

I guess its because apache ('

http://www')

owns the files and folders that is generated by the scripts, so it also shows folders that apache owns when someone ask for it.

How do I advoid this? I could just copy an empty "index.html" file into the created folders, but still it's not the "correct" way of doing it. (someone could just try with different folders and file, names until they hit the right names)

Can I somehow get a "Access denied" without having to desturb the guy who has the server?

 

[Wishdiak]

LocoPollo,

You could set up a .htaccess file that denies requests unless they come from specific IP addresses. You could also change the configuration so that specific directories don't list their contents.

http://httpd.apache.org/docs/howto/htaccess.html

http://httpd.apache.org/docs-2.0/howto/htaccess.html

http://httpd.apache.org/docs/mod/core.html#options

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[LocoPollo]

My new question is below the ---- line

Thanks! But geeez! I spend days on figuring out how to deal with that .htaccess file.
1. I had to place it in a folder that is 'owned' by apache, so had to make a lil script for that
2. It's invisible struggled for hours before I figured that out.
3. And had a hard time finding what to write in it

Anyway, I made it work this way:
made a file called '.htaccess'
wrote just 1 line:
'deny from all'
... and now I get this 403 Forbidden message then I try to see the content of the folders in a browser.

My script can still for some strange reason see the files and read them. They shouldn't be able to, but they can, so thats OK. I tried this to make it "correct" though:

order deny,allow
allow from 195.140.xxx.xxx
deny from all

...but then I get a internal server error.

----------

Last thing now:
Is it possible to do something so that people cant even see what folders excist?? I have been a bit stupid and named all my folder after the usernames, so it would be possible to see what users I had, by trying.

Just being a bit paranoid, but if its possible to show the '403 forbidden' message no matter what people enter in a browser, even folders that doesn't excist ...then it could be nice.

I was also suggested to move the folder out of apaches area "../../mysecretfolder", is that the best way, or can htaccess do it?

Thanks!

 

[Wishdiak]

LocoPollo,

For your .htacess file

order deny,allow
allow from 195.140.xxx.xxx
deny from all

Notice that the order directive places deny before allow. It's best practice to list the most restrictive directive first, so change it to

order allow,deny
allow from 195.140.xxx.xxx
deny from all

As far as files and folders, your DocumentRoot can be any directory anywhere. You might consider creating a new directory to place your files into.

And just to be thorough, your scripts (if they are executable CGI files) don't process the .htaccess file or any directives within.

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[LocoPollo]

Thanks!
Ohh, I thought the order, was to tell apache what to read first:
1. first I want to deny access for everyone
2. then allow a SINGLE IP.

I will try swap the order.

"And just to be thorough..." what do you mean? I only used the little script to be able to write the htaccess to a folder that is owned my "apache". I dont think I'm processing htaccess in them in generel, or am I?? if there is something I dont know about, let me know. If its just the little script, then I will remove it from the server right now.

And if anyone have some links to good tutorials on htaccess, please let me know.
I found this one for newbies myself:

http://corz.org/serv/tricks/htaccess.php

... but I think there is ALOT more.

Thanks again!

 

[Wishdiak]

LocoPollo,

Since you don't mention the version of Apache you are using, here are links to .htaccess files for both 1.x and 2.x.

http://httpd.apache.org/docs/howto/htaccess.html

http://httpd.apache.org/docs-2.0/howto/htaccess.html

I dont think I'm processing htaccess in them in generel, or am I??

Only the Apache webserver processes .htaccess files, if configured to do so. Other programs, and many executable scripts, will not.

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com