Saturday, October 30, 2021

[SOLVED] https works after comment out deny from all, but will there be any security problem?

Issue

I'm now working on installing certification of our website to https. I've tried for few days until I found one forum which to take note on deny from all which will block the access . So I comment out deny from all and now it works, but will there be any issue on security side? Below are the configuration used, are there any website that I can refer to for related command?

<Directory "${INSTALL_DIR}/www/abc">
	SSLOptions +StdEnvVars
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order Deny,Allow
Deny from all
    Allow from 127.0.0.1 localhost ::1
</Directory>


Solution

The Deny from all directive does exactly what it says it does: it blocks all requests, regardless of their origin. Ironically, the next line permits access if and only if the request originated from the same IP address, so this might be the safest configuration you can have, provided you don't mind having the most useless server of all time.

You only want to use the Deny from all to prevent access to the filesystem, otherwise it blocks all incoming requests, as you noticed. Then you specifically allow access only to the directories where you plan on serving files from, like so:

# Make the server filesystem completely off-limits
<Directory "/">
    # Do not permit .htaccess files to override this setting
    AllowOverride None

    # Deny all requests
    Require all denied
</Directory>

<Directory "${INSTALL_DIR}/www/abc">
    # If you want directories to be allowed to override settings
    AllowOverride All

    # Let people actually access the server content
    Require all granted
</Directory>

<Files ".ht*">
    # Make sure .htaccess file (which contain server configurations and
    # settings) are completely off-limits to anyone accessing the server,
    # even if they are in a directory that is otherwise accessible.
    Require all denied
</Files>

As far as the security of the server is concerned, the best advice I would give you is just make sure sensitive files and passwords are not stored in a directory accessible by the server. Even passwords in php files are not safe, because if a malignant actor is able to disable the php engine somehow, the file will be served in plain-text, with all of the sensitive information right there.

The best method of circumventing this is to create a configuration file outside the server root directory and using a SetEnv directive to define the variable.

SetEnv DATABASE_USERNAME "KobeBryantIsBetterThanJordan24"
SetEnv DATABASE_PASSWORD "LebronJamesIsAlsoPrettyGood107"

Then you can use something like this to get the variables into your php scripts without every exposing the information in plaintext.

$username = filter_input(INPUT_SERVER, 'DATABASE_USERNAME', FILTER_SANITIZE_STRING);
$password = filter_input(INPUT_SERVER, 'DATABASE_PASSWORD', FILTER_SANITIZE_STRING);

define('DATABASE_USERNAME', $username);
define('DATABASE_PASSWORD', $password);

Last but not least, make sure you add phpinfo to the disable_functions setting in your php.ini file, as that would immediately expose the password.



Answered By - Jose Fernando Lopez Fernandez
at