D8 doesn't create .htaccess for private file system path

Question

Following this guide: https://www.drupal.org/documentation/modules/file it says

"When you specify the private directory in admin/config/media/file-system it will automatically create the sub-directory & create a simple .htaccess file with Deny from all."

When you edit your settings.php and add the $settings['file_private_path'] = 'sites/default/files/private' after drush rc it doesn't create the .htaccess file in my sites/default/files/private and I do not know how the correct .htaccess should look so I could add it manually?

,

Answer 1

Try

Deny from all
# Turn off all options we don't need.
Options None
Options +FollowSymLinks

Answer 2

This is a better .htaccess to use:

# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>
<IfModule mod_php7.c>
  php_flag engine off
</IfModule>

This .htaccess is the one that should have been placed in your private files directory by Drupal 8 (or 9) core. (Perhaps permissions on the private directory prevented Drupal from creating the file.)

The accepted answer above is adequate to quiet the warning from Drupal status report, but does not actually prevent the remote script execution exploit addressed in the original core security advisory from 2013.

EDIT (2021-10-14):

I stand corrected. In the case of the private files directory, there's actually a bit more to it.

The .htaccess I posted above (last April) contains "Apache htaccess directives to prevent execution of files in a location."

This .htaccess is added to public file directories like ./sites/default/files/ to prevent remote execution of uploaded PHP scripts -- a vector for some very nasty exploits that can compromise not only your Drupal site, but in some cases your entire server.

But the very next method in Drupal\Component\FileSecurity contains "Apache htaccess directives to block access to a location."

That section looks like this:

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all
</IfModule>

The second .htaccess is the one which is necessary to prevent all remote access to a directory. In the case of the directories used for Drupal's private:// and temporary:// stream wrapper file paths, it would seem prudent to add both of these.

Also, if you installed Drupal a long time ago and have been upgrading incrementally, it might be good to check the .htaccess files in your public, private, temporary and config directories to make certain they are up to date. Sometimes when an older version is present, it prevents Drupal security hardening from adding the latest version.