Apache Rewrite Security Question

ddenton · 02-29-2008, 10:34 AM

Hello all.

I'm using Nessus to scan our apache installation for vulns and consistently get a warning about our mod_rewrite rules allowing trace/track debugging.

The rewrite rule suggested is:

RewriteRule .* - [F]

This is what we use:

RewriteRule ^/(.*)$ - [F]

Does this not perform the same function?

Thanks in advance...

ddenton · 02-29-2008, 10:59 AM

I found some docs on performing the test manually, and even after making the change to ".* - [F]", my apache install still returns a 200 when sending the TRACE request.

Any other suggestions? I'm running apache 2.2.4 with Jakarta/Tomcat 5.5.12 on RHEL4.

Thanks...

ddenton · 03-04-2008, 01:50 PM

Turns out the issue was the order of my conditions and rules.