Adding .htaccess within httpd.conf correctly

Question

I am looking for advice on the correct way to place my .htaccess settings within my httpd.conf. Here is the server httpd.conf with the htaccess placed within a directory as per most instructions I have found.

SuexecUserGroup "#502" "#502"
ServerName example.com
ServerAlias www.example.com
ServerAlias webmail.examplee.com
ServerAlias admin.example.com
DocumentRoot /home/example/public_html
ErrorLog /var/log/virtualmin/example.com_error_log
CustomLog /var/log/virtualmin/example.com_access_log combined
ScriptAlias /cgi-bin/ /home/example/cgi-bin/
ScriptAlias /awstats/ /home/example/cgi-bin/
DirectoryIndex index.html index.htm index.php index.php4 index.php5
<Directory /home/example/public_html>
Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
AddHandler fcgid-script .php
AddHandler fcgid-script .php5
FCGIWrapper /home/example/fcgi-bin/php5.fcgi .php
FCGIWrapper /home/example/fcgi-bin/php5.fcgi .php5
</Directory>
<Directory /home/example/cgi-bin>
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
</Directory>
RewriteEngine on
RewriteCond %{HTTP_HOST} =webmail.example.com
RewriteRule ^(.*) https://example.com:20000/ [R]
RewriteCond %{HTTP_HOST} =admin.example.com
RewriteRule ^(.*) https://example.com:10000/ [R]
RemoveHandler .php
RemoveHandler .php5
php_admin_value engine Off
IPCCommTimeout 61
FcgidMaxRequestLen 1073741824
Alias /pipermail /var/lib/mailman/archives/public
<Files awstats.pl>
AuthName "example.com statistics"
AuthType Basic
AuthUserFile /home/example/.awstats-htpasswd
require valid-user
</Files>
<Directory /home/example/public_html>
AllowOverride None
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
</FilesMatch>
Options -Indexes
Options +SymLinksifOwnerMatch
ErrorDocument 404 /index.php
DirectoryIndex index.php index.html index.htm
<IfModule mod_php5.c>
  php_flag magic_quotes_gpc                 off
  php_flag magic_quotes_sybase              off
  php_flag register_globals                 off
  php_flag session.auto_start               off
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_flag mbstring.encoding_translation    off
</IfModule>
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault A1209600
  <FilesMatch \.php$>
    ExpiresActive Off
  </FilesMatch>
</IfModule>
<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteRule ^ - [E=protossl]
  RewriteCond %{HTTPS} on
  RewriteRule ^ - [E=protossl:s]
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  RewriteRule "(^|/)\." - [F]
   RewriteCond %{HTTP_HOST} .
   RewriteCond %{HTTP_HOST} !^www\. [NC]
   RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteRule ^ index.php [L]
  <IfModule mod_headers.c>
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.css $1\.css\.gz [QSA]
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.js $1\.js\.gz [QSA]
    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1]
    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1]
    <FilesMatch "(\.js\.gz|\.css\.gz)$">
      Header set Content-Encoding gzip
      Header append Vary Accept-Encoding
    </FilesMatch>
  </IfModule>
</IfModule>
</Directory>

Often Drupal updates come along and add in a .htaccess and due to my setup (virtualmin servers on a Centos machine) I have to go through each site after update and change the htaccess files on each so I would like any .htaccess to be ignored. Setting AllowOverride None in the public directory should block(ignore) these but then I am unsure if the subsequent Overrides have an impact on this.

The config works but is dirty (duplication and overrides of overrides :S) so in essence I would like to clear it up. What is provided is the raw drop in, I think I should be able to delete some permissions but not sure

Apache makes it very clear that if you have access to httpd.conf it SHOULD be used instead of .htaccess but I have been unable to find any info about the correct config for drupal apart from 'wrap in directory and drop it in'....

There is no clear documentation on Drupal.org so please don't bounce this over to SE or SO, it is very drupal centric and with D8 about to land and Apache 2.4 finally landing in many server repos htaccess and httpd.conf will cause many people headaches so this will be helpful to many drupalers !

Here is some additional for those that some who use .htaccess may not be aware of: From the Drupal Installation docs: Step 6: Configure clean URLs:

If you have complete control of your server, for example: You run your own server; are installing a development site on your personal computer; or you have a dedicated server hosting account, then you should enable clean URLs in the httpd.conf file for better performance and security.

Here is an outstanding D7 & D8 patch that is aiming to remedy some of the permission (override) issues that I am trying to clarify: +FollowSymLinks to +SymLinksIfOwnerMatch

Answer 1

I still don't know why more people do not use include like this. All you have to do is restart apache for changes in drupal's .htaccess to take effect.

<Directory "/var/www/html">
  Options Indexes FollowSymLinks
  AllowOverride none
  Order allow,deny
  Allow from all

  # For Drupal, the rules in .htaccess are included here.
  RewriteEngine on
  RewriteBase /
  Include /var/www/html/.htaccess
</Directory>

# Enforce new security rules from SA-CORE-2013-003.
<Directory "/var/www/html/sites/*/files">
  # Turn off all options we don't need.
  Options None
  Options +FollowSymLinks

  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  <Files *>
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
  </Files>

  # If we know how to do it safely, disable the PHP engine entirely.
  <IfModule mod_php5.c>
    php_flag engine off
  </IfModule>
</Directory>

Change /var/www/html to /home/example/public_html in your case.