I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64
).
I wonder, how to properly configure the Drupal_Security_Do_Not_Remove_* handlers in my /etc/httpd/conf/httpd.conf
file since .htaccess
files are disabled at my server by AllowOverride None
directive.
Currently I have the following sections in httpd.conf
for each of my sites:
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
......
<VirtualHost 123.123.123.123:80>
DocumentRoot /var/www/html/mysite1.de
ServerName mysite1.de
ServerAlias mysite1.de *.mysite1.de
<IfModule mod_rewrite.c>
<Directory "/var/www/html/mysite1.de">
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^ index.php [L]
</Directory>
</IfModule>
</VirtualHost>
And the recommended settings for the .htaccess
are those here:
Options None
Options +FollowSymLinks
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
Should the result in my case be the following?
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
......
<VirtualHost 123.123.123.123:80>
DocumentRoot /var/www/html/mysite1.de
ServerName mysite1.de
ServerAlias mysite1.de *.mysite1.de
Options None
Options +FollowSymLinks
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files /var/www/html/mysite1.de/sites/default/files/*>
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
<IfModule mod_rewrite.c>
<Directory "/var/www/html/mysite1.de">
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^ index.php [L]
</Directory>
<Directory "/var/www/html/mysite1.de/sites/default/files">
php_flag engine off
</Directory>
</IfModule>
</VirtualHost>
AllowOverride
has no bearing on this question...which is essentially, "If I put this Drupal directive here, am I still plugging the security hole that it was introduced to stop, bearing in mindAllowOverride
is set toNone
?"AllowOverride None
directive, which the OP asserts that there is, then any directives in .htaccess are moot; completely un-used. I'm not sure why you'd assume there are further directives on specific subfolders of the site, when the OP hasn't mentioned it. I'm sure you're just trying to second-guess other potential issues and provide helpful solutions to those, but it might be better to address what's in the question :).htaccess
part - for JhilkeDai - eventhough it doesn't really matter here. Yes, I'd like to know, if I have plugged the Drupal security holes properly by myhttpd.conf
.