Up to 2.4.54; fixes CVE-2022-31813, CVE-2022-30556, CVE-2022-30522, CVE-2022-29404...

[packages/apache.git] / apache-common.conf

diff --git a/apache-common.conf b/apache-common.conf
index 05686e9666a584d6725887cd3a9bf8424e295489..714c05bead7dda1d3d5beffd6c259b46861a54c5 100644 (file)
--- a/apache-common.conf
+++ b/apache-common.conf
@@ -16,11 +16,40 @@ DocumentRoot "/home/services/httpd/html"
        Options FollowSymLinks
        AllowOverride None
        <IfModule mod_authz_host.c>
+               Require all denied
+       </IfModule>
+       <IfModule mod_access_compat.c>
                Order deny,allow
                Deny from all
        </IfModule>
 </Directory>
 
+# Prevent access to:
+# - .htaccess and .htpasswd files
+# - backup files from being viewed
+# - PHP's .user.ini
+<FilesMatch  "^(\.ht.*|\.user\.ini|.*~|.*,v)$">
+       <IfModule mod_authz_host.c>
+               Require all denied
+       </IfModule>
+       <IfModule mod_access_compat.c>
+               Order deny,allow
+               Deny from all
+       </IfModule>
+</FilesMatch>
+
+# Prevent access to:
+# - version control directories
+<DirectoryMatch "/(\.(svn|git|hg|bzr)|CVS)/?">
+       <IfModule mod_authz_host.c>
+               Require all denied
+       </IfModule>
+       <IfModule mod_access_compat.c>
+               Order deny,allow
+               Deny from all
+       </IfModule>
+</DirectoryMatch>
+
 #
 # This should be changed to whatever you set DocumentRoot to.
 #
@@ -34,7 +63,7 @@ DocumentRoot "/home/services/httpd/html"
        # doesn't give it to you.
        #
        # The Options directive is both complicated and important.  Please see
-       # http://httpd.apache.org/docs/2.2/mod/core.html#options
+       # https://httpd.apache.org/docs/2.4/mod/core.html#options
        # for more information.
        #
        Options Indexes FollowSymLinks
@@ -50,6 +79,9 @@ DocumentRoot "/home/services/httpd/html"
        # Controls who can get stuff from this server.
        #
        <IfModule mod_authz_host.c>
+               Require all granted
+       </IfModule>
+       <IfModule mod_access_compat.c>
                Order allow,deny
                Allow from all
        </IfModule>