Re: apache manual language

On Mon, Sep 16, 2002 at 03:28:00PM +0100, Rui Miguel Silva Seabra wrote:
> I think that this is pretty darn obvious but if you have:
> 
>   * FollowSymLinks
>     you immediately have ln -s /sentive/file fileOnTheWeb
>   * Indexes
>     potential directory disclosures
>   * MultiViews
>     potential bugs due to more complex code

MultiViews is only enabled by default for the the manual directory;  
disabling FollowSymLinks is a performance hit; maybe Indexes should be
indeed be off by default, could you file a bugzilla bug on that?

> The default should have Options None
> 
> While we're at it, you should use:
> ServerSignature Off      # currently you leave it on
> ServerTokens Prod        # currently not even used
> 
> While, usually, minor issues, the default configuration gives away too
> much information, easing up the lives of script kiddies all around :)

The default as of the beta releases is currently "ServerTokens OS" which
makes the default Server header "Apache/2.0.x (Red Hat Linux)".

Regards,

joe