Trent King CIT 436 Lab 4

.docx

School

University of Phoenix *

*We aren’t endorsed by this school

Course

0102

Subject

Computer Science

Date

May 4, 2024

Type

docx

Pages

6

Uploaded by ProfWillpower13160 on coursehero.com

Trent King CIT 436 2/4/2024 Lab 4  Here, we look at <Directory> containers. a. (2) Search forward for <Directory />. This is the first <Directory> container in the file. What does / reference? Upon searching for <Directory /> in the httpd.conf file, I found that it references the root directory of the entire file system. This directive is set to disallow all access by default, enhancing the security by preventing unauthorized access to the entire filesystem from the web. The container disallows all access to this directory and all beneath it. (2) The next <Directory> container is for DocumentRoot. It contains Options, AllowOverride directives and Require all granted. What does the Require directive do and why is it necessary for this directory? The Require all granted directive allows access to the DocumentRoot directory, making it necessary to ensure the website's content is accessible to all users. Options allows us to specify what options are allowed or not allows for requests in this directory (and subdirectories as options are inherited). What Options are permited for DocumentRoot? For the DocumentRoot, I permitted options Indexes, FollowSymLinks, and ExecCGI, enabling directory listings, following symbolic links, and executing scripts. Create a new <Directory> container beneath the one for DocumentRoot for /usr/local/apache2/htdocs/second (recall the container will end with </Directory>). Place Options -FollowSymLinks in this container, save your conf file, and (1) restart Apache. In your web browser, test second/users. What happens? You tested this earlier (prior to step 1) and it should have worked, why did it not work now? What does -FollowSymLinks mean? If you had a subdirectory beneath second, would that subdirectory permit or not permit symbolic links to be followed? After creating a new <Directory> container for /usr/local/apache2/htdocs/second with Options - FollowSymLinks and restarting Apache, testing second/users in the web browser resulted in an error, specifically, the symbolic link to /etc/passwd could not be followed. Previously, this link worked because symbolic links were allowed by default. The -FollowSymLinks option disables the ability to follow symbolic links, enhancing security by preventing access to files outside of the intended directory structure. Consequently, with -FollowSymLinks set for the second directory, any subdirectory beneath second would also inherit this restriction, disallowing the following of symbolic links unless explicitly overridden by another directive at a deeper level. In your web browser, try the URL ipaddress/second (no filename) which should result in either returning an index file or displaying the directory’s contents. Which one happens here? When I tried accessing the URL ipaddress/second without specifying a filename, Apache returned the directory's contents as a listing. This behavior indicates that the Options directive for this directory includes Indexes, allowing the server to display a list of files in the directory when no specific index file is present or specified in the request. Change the directive you added in 2b to Options -Indexes. Save the file and (1) restart Apache. Refresh your browser. Instead of the directory listing, you get an error. What error? Why didn’t you get an index file?
Changing to Options -Indexes and refreshing the browser led to a 403 Forbidden error because this setting prevents directory listings and no index file was available to be served. Change the Options statement to Options Multiviews, save your conf file, (1) restart Apache and refresh your browser. What happens this time? Setting Options Multiviews, restarting Apache, and refreshing the browser enabled content negotiation, allowing Apache to serve the closest match for the request from the second directory. Add a + before Multiviews in the Options directive, save your conf file, (1) restart Apache and refresh your browser. What happens now? What can you conclude about Options that have minus (-) versus Options that have no sign before them versus Options that have a plus (+)? Adding +Multiviews, restarting Apache, and refreshing showed similar content negotiation as before. The + adds to existing options, - removes them, and no sign sets options directly, allowing precise control over Apache's directory behaviors. With Options +MultiViews, Indexes is inherited again from DocumentRoot. Now we can change how the directory listing appears in the web browser. (2) In the <Directory> container for second, add the directive IndexOptions +FancyIndexing, save the conf file, (1) restart Apache, and refresh browser. How does the directory listing differ from how it appeared in 1c? After adding IndexOptions +FancyIndexing, restarting Apache, and refreshing, the directory listing became more detailed and visually appealing, showing file icons, sizes, and modification dates, unlike the basic list seen before. Replace +MultiViews with -Indexes and delete the IndexOptions directive. We do this because Indexes constitutes a security problem. Why? Replacing +MultiViews with -Indexes and deleting the IndexOptions directive is done because allowing directory listings can be a security risk. It exposes the structure and contents of the server's directories to anyone, potentially revealing sensitive files or information about the server setup that could be exploited by attackers. Removing Indexes prevents unauthorized directory browsing, enhancing the server's security. In your web browser, type the URL ipaddress. This loads your index file, but which one? When I typed the URL ipaddress into my web browser, it loaded the index.html file. This is because the Apache configuration file's DirectoryIndex directive prioritizes index.html as the default file to display when no specific file is requested in the URL. A little below the <Directory> container for second you should find the <IfModule> container for dir_module which has one directive, DirectoryIndex. This directive specifies valid names for index files. Add index.txt after index.html in this directive, save your conf file, (1) restart Apache and refresh your browser. What index file does Apache respond with? After adding index.txt after index.html in the DirectoryIndex directive within the <IfModule> container for dir_module, saving the configuration file, restarting Apache, and refreshing my browser, Apache responded with the index.html file. This is because DirectoryIndex searches
for the listed files in the order they are specified, serving the first one it finds. Since index.html exists and is listed before index.txt, it is served to the client. Reverse the order of the two file names in the directive, save the conf file, (1) restart Apache and refresh your browser. Which version loads now? What can you conclude about the DirectoryIndex directive? After reversing the order of the file names in the DirectoryIndex directive to list index.txt before index.html, saving the configuration file, restarting Apache, and refreshing my browser, Apache served the index.txt file. This demonstrates that the DirectoryIndex directive prioritizes the files in the order they are listed. If the first listed file is found, it is served, and Apache does not continue to look for the subsequent files. This behavior allows for flexibility in specifying default documents for a directory. In steps d and e you have seen the role of Options Indexes and DirectoryIndex. Describe all of the possibilities that Apache will respond with when it receives a URL which contains no filename, such as ipaddress or ipaddress/second. If Indexes enabled and no DirectoryIndex file: Displays directory listing. If Indexes disabled and no DirectoryIndex file: Returns a 403 Forbidden error. If a DirectoryIndex file exists: Serves that file. If no DirectoryIndex file exists and Indexes disabled: Also returns a 403 Forbidden error. You want to change Options or some other directives for your directory but you cannot add or modify the <Directory> container in the conf file. Should you ask the web administrator to make the changes? No, Apache gives us a better way: the access file. Apache allows using an .htaccess file for directory-level configuration changes. This method enables me to modify Options and other directives without editing the main httpd.conf file, eliminating the need to ask the web administrator for these changes. Type fg to resume vi. The <Files> container matches .htaccess and has one directive: to deny access. Does this mean that you, as the web developer, cannot use an access file? Explain. The <Files> directive that denies access to .htaccess files is for security, ensuring they're not accessible via a web browser. However, this doesn't affect my ability to use .htaccess for configuration; the server still reads and applies these files, keeping the configurations effective while securing them from external access. This creates .htaccess with the directive in place to permit Indexes (which overrides what the <Directory> container did in the conf file). In your web browser, enter the URL ipaddress/second. What happens? Why didn’t the access file override the Option in the <Directory> container as expected? When I entered ipaddress/second in my web browser after creating .htaccess with Options +Indexes, it didn't override the -Indexes setting from httpd.conf as expected. This  occurred because the AllowOverride directive for the directory in httpd.conf was set to None or didn't specifically allow overriding Options, preventing .htaccess from enabling directory listings. Scroll back to the <Directory> container for htdocs and you will find AllowOverride None. Change this to AllowOverride All, save your conf file, (1) restart Apache and refresh your browser. Did these changes work? The AllowOverride directive is used to control what access
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
  • Access to all documents
  • Unlimited textbook solutions
  • 24/7 expert homework help