web server files need protection from being browsed

frieza · 01-20-2009, 04:25 PM

i'm hosting a LAMP server that has confidential data, the short of the problem is how can i secure the files so that only the php scripts can read the data in the files but not allow users to open the data files in the browser?

rylan76 · 01-21-2009, 01:03 AM

You should be able to setup a .htaccess file that will restrict the files from being viewed by the Apache user, but you should be able to access them with PHP directly. The Apache docs might be a good place to take a look, search under ".htaccess format" or some similar string.

tanveer · 01-21-2009, 02:48 AM

Does your problem is like users can browse the content all the docs like a ftp?

To stop this just remove the Indexes option from httpd.conf which I think you already know.

And I don't know if this is possible with .htaccess to restrict users from reading docs, I am also interested.

anomie · 01-21-2009, 09:29 AM

Quote:

Originally Posted by frieza

how can i secure the files so that only the php scripts can read the data in the files but not allow users to open the data files in the browser?

Example (denying access to .dat files and .doc files):

Code:

<FilesMatch "(.dat$|.doc$)">
    Order Allow,Deny
    Deny from all
</FilesMatch>

See: http://httpd.apache.org/docs/2.0/mod...tml#filesmatch