Re: apache manual language

On Mon, 2002-09-16 at 15:15, Joe Orton wrote:
> On Wed, Sep 11, 2002 at 08:02:44PM -0700, Shaun Savage wrote:
> > the option MultiViews need to added to the location /var/www/manual
> > <Location /var/ww/manual>
> > 	Options	.........  MultiViews
> > 	......
> > 	......
> > </Location>
> Hi - what problem are you seeing, exactly? The default configuration 
> already has:
> <Directory "/var/www/manual">
>     Options Indexes FollowSymLinks MultiViews
> ..

I think that this is pretty darn obvious but if you have:

  * FollowSymLinks
    you immediately have ln -s /sentive/file fileOnTheWeb
  * Indexes
    potential directory disclosures
  * MultiViews
    potential bugs due to more complex code

The default should have Options None

While we're at it, you should use:
ServerSignature Off      # currently you leave it on
ServerTokens Prod        # currently not even used

While, usually, minor issues, the default configuration gives away too
much information, easing up the lives of script kiddies all around :)

Rui

-- 
+ No matter how much you do, you never do enough -- unknown
+ Whatever you do will be insignificant,
| but it is very important that you do it -- Gandhi
+ So let's do it...?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQA9hepwo+C50no0+t4RAidqAJ99IxM3kQJwlGiaUnaQiodiP8mOawCgr4UO
LXsbjh7v1LATS0bBzzt3foc=
=BBWZ
-----END PGP SIGNATURE-----