I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64
).
I wonder, how to properly configure the Drupal_Security_Do_Not_Remove_* handlers in my /etc/httpd/conf/httpd.conf
file since .htaccess
files are disabled at my server by AllowOverride None
directive.
Currently I have the following sections in httpd.conf
for each of my sites:
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
......
<VirtualHost 123.123.123.123:80>
DocumentRoot /var/www/html/mysite1.de
ServerName mysite1.de
ServerAlias mysite1.de *.mysite1.de
<IfModule mod_rewrite.c>
<Directory "/var/www/html/mysite1.de">
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^ index.php [L]
</Directory>
</IfModule>
</VirtualHost>
And the recommended settings for the .htaccess
are those here:
Options None
Options +FollowSymLinks
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
Should the result in my case be the following?
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
......
<VirtualHost 123.123.123.123:80>
DocumentRoot /var/www/html/mysite1.de
ServerName mysite1.de
ServerAlias mysite1.de *.mysite1.de
Options None
Options +FollowSymLinks
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files /var/www/html/mysite1.de/sites/default/files/*>
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
<IfModule mod_rewrite.c>
<Directory "/var/www/html/mysite1.de">
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^ index.php [L]
</Directory>
<Directory "/var/www/html/mysite1.de/sites/default/files">
php_flag engine off
</Directory>
</IfModule>
</VirtualHost>
AllowOverride
has no bearing on this question...which is essentially, "If I put this Drupal directive here, am I still plugging the security hole that it was introduced to stop, bearing in mindAllowOverride
is set toNone
?" – Clive♦ Nov 21 '13 at 10:51AllowOverride None
directive, which the OP asserts that there is, then any directives in .htaccess are moot; completely un-used. I'm not sure why you'd assume there are further directives on specific subfolders of the site, when the OP hasn't mentioned it. I'm sure you're just trying to second-guess other potential issues and provide helpful solutions to those, but it might be better to address what's in the question :) – Clive♦ Nov 21 '13 at 11:29.htaccess
part - for JhilkeDai - eventhough it doesn't really matter here. Yes, I'd like to know, if I have plugged the Drupal security holes properly by myhttpd.conf
. – Alexander Farber Nov 21 '13 at 12:48