LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > *BSD
User Name
Password
*BSD This forum is for the discussion of all BSD variants.
FreeBSD, OpenBSD, NetBSD, etc.

Notices

Reply
 
Search this Thread
Old 03-06-2006, 02:01 AM   #1
noir911
Member
 
Registered: Apr 2004
Location: Baltimore, MD
Posts: 681

Rep: Reputation: Disabled
apache mod_rewrite {TRACE|TRACK} woes


I'd like to disable Trace/ Track on apache 1.3.29. Googling on how to do that turns out a lot of results like

Code:
 
<IfModule mod_rewrite.so>
    RewriteEngine on
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
    RewriteRule .* - [F]
</IfModule>
Now where exactly should I add it? Should I add it in the Global Section or the DocumentRoot section or VHost section? I have added it up in all the sections but I can still see trace/ track is enabled.

Last edited by noir911; 03-06-2006 at 02:02 AM.
 
Old 03-06-2006, 10:18 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Most of the documentation seems to say that you can put it anywhere in the http config of htaccess files. However, I was tinkering around with the Rewrite rule and noticed if you put it inside the 'ifModule' container it will not work. Once I removed the ifModule container the Rewrite rule worked fine and you'll notice startup takes a little longer which is likely the Rewrite module loading. Also make sure to use 'httpd -t' to verify that your syntax is ok.

If you ever switch to a newer version of Apache (1.3.34+ or 2.0.22+) you should consider using the 'TraceEnable off' directive as it's a much better way of forbidding the Trace method and will use less resources than a Rewrite rule.

Also, as far as I am aware, the TRACK http method is not supported by Apache at all and is a Microsoft IIS thing. A quick test using the TRACK method on any of my Apache servers returns a 501 "Method Not Implemented" Error. So you may want to remove that from your rule.
 
Old 03-07-2006, 02:37 AM   #3
noir911
Member
 
Registered: Apr 2004
Location: Baltimore, MD
Posts: 681

Original Poster
Rep: Reputation: Disabled
I tried different ways -

Code:
    RewriteEngine on
    RewriteCond %{REQUEST_METHOD} ^(TRACE)
    RewriteRule .* - [F]
or

Code:
    RewriteEngine on
    RewriteCond %{REQUEST_METHOD} ^TRACE
    RewriteRule .* - [F]
doesn't solve the problem.

This is Apache/1.3.29 on OpenBSD running in a chroot environment.
 
Old 03-07-2006, 06:22 AM   #4
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Are you restarting the Apache daemon each time, so that it re-reads the config? Also how are you 'testing' whether the TRACE method works? Are you sure that the Rewrite module is uncommented under the LoadModule directives and is being loaded?

//Moderator note: Since this is a BSD question, I'm going to move this thread to the *BSD forum.
 
Old 03-08-2006, 02:16 AM   #5
noir911
Member
 
Registered: Apr 2004
Location: Baltimore, MD
Posts: 681

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Capt_Caveman
Are you restarting the Apache daemon each time, so that it re-reads the config? Also how are you 'testing' whether the TRACE method works? Are you sure that the Rewrite module is uncommented under the LoadModule directives and is being loaded?
[1] Yup, restarting apache each time; eg "httpd -t" "apachectl stop" "apachectl start"

[2] Yes, testing with nikto

[3] Yes, the rewrite module is uncommented. I have actually compiled the module from source using apxs(8).

Could this be a module permission problem?

/usr/lib/apache/modules/mod_rewrite.so --> has permission of root:bin along with -rwxr-xr-x.

Apache runs on chroot jail.
 
Old 03-08-2006, 02:54 AM   #6
noir911
Member
 
Registered: Apr 2004
Location: Baltimore, MD
Posts: 681

Original Poster
Rep: Reputation: Disabled
I been testing and just realized that it behaves differently depending on where you put it.

From a document --

Quote:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* [F]

"Remember to place these directives in a <Location /> container, or outside all containers."
However, if I put it in <Direcroty /> or <Directory /path/to/homepage>, Nikto goes crazy. Should I put it under each and every <Directory ...> then?
 
Old 03-08-2006, 10:30 AM   #7
sigsegv
Senior Member
 
Registered: Nov 2004
Location: Third rock from the Sun
Distribution: NetBSD-2, FreeBSD-5.4, OpenBSD-3.[67], RHEL[34], OSX 10.4.1
Posts: 1,197

Rep: Reputation: 46
I put mine in the global httpd.conf (you can put it in an included file too) and it looks like this:

RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$
RewriteRule .* - [F]

YMMV of course.
 
Old 03-08-2006, 08:38 PM   #8
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Does it work if you simply put it in the httpd.conf without any container at all?

I've put mine in the either the main or global sections (without any containers at all) and it works equally as well. I would highly recommend against putting it in per-directory containers unless you absolutely need to as it will significantly affect the handling time due to the way Apache maps the requests.
 
Old 03-09-2006, 12:55 AM   #9
noir911
Member
 
Registered: Apr 2004
Location: Baltimore, MD
Posts: 681

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by sigsegv
RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$
RewriteRule .* - [F]
Thanks! This seems to work fine. I have put it in the Main Container. Putting it in the Global Container gives syntax error.

Thanks again guys.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Apache Mod_rewrite help! soulsniper Linux - Software 0 01-16-2005 05:23 PM
Using mod_security to disallow TRACE|TRACK Cerbere Linux - Security 1 09-27-2004 12:57 PM
Apache:mod_rewrite MadMikie Linux - Software 0 08-03-2004 07:33 AM
Apache (mod_rewrite) question Wonko the Sane Linux - Software 1 06-15-2003 12:55 PM
Apache and mod_rewrite notsoevil Linux - General 0 01-23-2002 01:39 PM


All times are GMT -5. The time now is 04:54 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration