Secure apache folders?

zeveck · Posted: Sun Oct 16, 2005 8:31 pm Post subject: Secure apache folders?

How do I make it so that apache will not surve up a given folder to a web user?

Say there are files in that folder that I want the user to be able to download. Any pointers on how to make it so that user can download them via a PHP script?

adaptr · Posted: Sun Oct 16, 2005 8:47 pm Post subject:

Plenty. Google for "apache download php scripts" and you'll be reading the rest of the year...

You need to think about what it is you want - there are at least 3 different concepts and/or questions in your post.
The first one can already be achieved in 3 different ways (or more).
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen

zeveck · Posted: Sun Oct 16, 2005 8:58 pm Post subject:

Monkeh · Veteran Joined: 06 Aug 2005 Posts: 1656 Location: England

zeveck · Posted: Mon Oct 17, 2005 12:10 am Post subject:

Not quite what I meant. I mean, then the user could still just do /uploads/foo.txt if they guessed the file name, right?

Monkeh · Veteran Joined: 06 Aug 2005 Posts: 1656 Location: England

Yes. The only other way I can think of is passworded folders, or perhaps strict referer blocking. However, you could always just go with hard to guess file names. Try.. uploads/f0O.txt for example.

pdr · l33t Joined: 20 Mar 2004 Posts: 618

Make the directory outside of your documentroot.

adaptr · Posted: Mon Oct 17, 2005 9:34 pm Post subject:

And they will be able to download files.. how, exactly ?
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen

pdr · l33t Joined: 20 Mar 2004 Posts: 618

Uh.. I thought the whole point here is to make it so people can't download files? Or is this a case of "I want to secure some of the files in a directory"? If so - move them into a different directory, serve one directory, don't serve the other directory.

zeveck · Posted: Tue Oct 18, 2005 12:48 pm Post subject:

Doesn't work. I want to serve all files in a directory, but only to specific users. It is a problem if other users could get at the files just by guessing the URL. The question is how to secure the directory and still somehow make the files available.

(nice avatar)

xces · Guru Joined: 11 Oct 2002 Posts: 515

Have you read the howto Authentication, Authorization and Access Control in the Apache manual? :roll: