Re: [mod-security-users] Restriction to / dir

[Ivan R. <iv...@we...>]

>>>  What kind of restriction? Do you mean the root (/) of the
>>>  file system, or the root of the web server?
> 
> 
> Yes, I meant the root of file system.
> With /boot I can block access to the /boot dir but I'm not sure
> how can I block the upper (root) dir.
> 
> 
>>>  Both are possible. You don't need mod_security, mod_access
>>>  (built-in) already supports that with Allow and Deny
>>>  directives.
> 
> 
> seems not possible.
> how can I block root system dir with deny directive?

   Like this:

   # First you block everything
   <Directory />
      Order Deny,Allow
      Deny from all
   </Directory>

   # Then allow what you want
   <Directory /home/www>
      Order Deny,Allow
      Allow from all
  </Directory>

  The code above will tell the web server not to serve
  files that are not in the /home/www subdirectory (/, /boot, whatever).

  If you want a solution to prevent someone from exploiting a
  vulnerable script and trick it into serving a file from the
  root of the file system: the only real protection is to
  chroot the web server or your scripts (if we are talking CGI,
  use the safe mode for PHP).

  ModSecurity can scan parameters for suspicious strings but it's
  not foolproof. It needs something distinctive to act upon. For
  example, protecting "/boot" is easy. But the root "/" - not simple.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]