7

I had a terrifying issue a few days ago. I was installing updates on my ubuntu server, which is a hosts for about 10 websites. During the update, something went wrong, and apaches mod_php became disabled. As a result, PHP support was gone, and for a few minutes (until I figured what's wrong) users got an invitation to download PHP scripts, instead of seeing a website. Needless to say, there is nothing worse then exposing your script sources to the whole world, especially when database credentials are kept inside.

The question: How can I configure apache, so this situation would not be possible in the future? What lines should I add to apache2.conf, so that PHP files could not be downloaded, if mod_php is disabled?

Silver Light
  • 44,202
  • 36
  • 123
  • 164

2 Answers2

9

Just add the following to the .htaccess in the root directory

php_admin_flag engine on

In this case user will get HTTP 500 error trying to read any file from this dir and below because no module defines php_admin_flag directive in case mod_php is off.

Vladislav Rastrusny
  • 29,378
  • 23
  • 95
  • 156
  • 1
    Interesting approach; I think what I propose below is still a better approach, as it will work without .htaccess files being enabled at all. – El Yobo Dec 02 '10 at 11:26
  • Thanks, great idea. Will the work in a global configuration (apache2.conf)? I don't want to forget to edit a .htaccess file and end up with the same result... – Silver Light Dec 03 '10 at 07:52
  • @Silver Light: yes, it will work in apache2.conf also, but disabling PHP module in this case will prevent the whole server from starting – Vladislav Rastrusny Dec 14 '10 at 21:22
5

A more secure approach would be simply to not put things you don't want accessed in the document root in the first place. See my answer here which provides more detail; the basic idea is, if you don't ever want a file accessed via URL, don't put the damn file in a URL accessible place. 99% of your app code should not be under the document root; then it doesn't really matter what you do to your apache/php setup, you're still safe.

Community
  • 1
  • 1
El Yobo
  • 14,823
  • 5
  • 60
  • 78
  • A very good advice, thanks. This does not quite solve the problem, because I at least must put index.php in the document root, am I not? – Silver Light Dec 03 '10 at 07:51
  • Yes, but you're not trying to protect that; or rather, nothing important would be there. My index.php has about 2 lines, which just creates a controller and calls it; this takes care of everything else. – El Yobo Dec 03 '10 at 12:44