Trying to turn Trace Off in Apache

dobryan · 06-20-2011, 09:47 AM

I am trying to turn Trace off on Apache/2.0.52. From one of the previous postings on this site it was stated that TraceEnable should be used for newer version of Apache (1.3.34+ or 2.0.22+). However, when I tried to use the man pages to get some information on how to use the command I got "No manual entry for TraceEnable". Can you tell me what version(s) of Apache supports this command?

paulsm4 · 06-20-2011, 10:16 AM

SUGGESTION:
1. Find your httpd.conf director(ies)

2. "grep" for "trace"

Code:

   EXAMPLE:
   cd /etc/httpd (as root)
   grep -i trace conf*/*

conf.d/zz010_psa_httpd.conf:TraceEnable off
conf.d/zz010_psa_httpd.conf.org:TraceEnable off
  <= This happen to be "/etc/httpd/conf" and "/etc/httpd/conf.d"
     on a Centos 5.x VPS.  Your files/directories will vary...

chrism01 · 06-20-2011, 06:56 PM

Also, re man pages; these are really for OS level cmds (mostly). TraceEnable is a cmd (setting) within the Apache conf files, so is unlikely to have a man page.
Not every box has a webserver on it.

HTH.

You may find these useful

http://rute.2038bug.com/index.html.gz
http://linux.die.net/man/
http://httpd.apache.org/

dobryan · 06-28-2011, 12:39 PM

I tried using the following code that I found in the Apache link but it doesn't seem to be working. It could be that I didn't put it into the correct location in the httpd.conf file. Does anyone know where and how this snippet of code need to be put into the httpd.conf file?

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

Thanks for the suggestions.

bathory · 06-28-2011, 01:16 PM

Quote:

Originally Posted by dobryan

I tried using the following code that I found in the Apache link but it doesn't seem to be working. It could be that I didn't put it into the correct location in the httpd.conf file. Does anyone know where and how this snippet of code need to be put into the httpd.conf file?

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]

Thanks for the suggestions.

This should be added inside a <VirtualHost ...>...</VirtualHost> stanza.
But it's easier to use "TraceEnable Off" in httpd.conf (or apache2.conf if you're using debian and derivatives)

Regards

dobryan · 06-28-2011, 02:22 PM

Thanks. Everything that I have found so far says that TraceEnable was not supported in Apache until after version 2.0.55. Unfortunately I am running Apache version 2.0.52.

sandwormusmc · 06-28-2011, 03:25 PM

Quote:

Originally Posted by dobryan

Thanks. Everything that I have found so far says that TraceEnable was not supported in Apache until after version 2.0.55. Unfortunately I am running Apache version 2.0.52.

For security and new feature reasons, you should probably update ... also make sure you're restarting Apache after your config file changes (seems minor but it's easy to forget

)

bathory · 06-28-2011, 03:45 PM

Quote:

Originally Posted by dobryan

Thanks. Everything that I have found so far says that TraceEnable was not supported in Apache until after version 2.0.55. Unfortunately I am running Apache version 2.0.52.

If you can't upgrade to a more recent version (better 2.2.19 if possible), then you should use the rewrite workaround.

Regards

chrism01 · 06-28-2011, 06:05 PM

Also, if you've got a RH derived distro, they do back-port some stuff, mostly security but occasionally other stuff as well.
You can't just go by the Apache version num, you'd have to check the release num+notes.