Is there a standard place to put the rewrite conditions so that all of the virtual host are covered and/or so that new virtual host are covered automatically?
Background:
We just had a security audit and one of the few things that they found was that our ispconfig server allowed HTTP TRACE and HTTP TRACK methods. We need to disable them. 'mod_rewrite' is already part of the standard ispconfig configuration so we just need to add the following
...
# disable TRACE and TRACK in the main scope of httpd.conf
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]
...
<VirtualHost www.example.com>
...
# disable TRACE and TRACK in the
www.example.com virtual host
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
RewriteCond %{REQUEST_METHOD} ^TRACK
RewriteRule .* - [F]
</VirtualHost>
I know the the virtual host are configured in /etc/httpd/conf/vhosts/Vhosts_ispconfig.conf
Is there an easier way than editing that file for each virtual host?
Thanks,
Reece Dike
Recent comments
13 hours 1 min ago
18 hours 6 min ago
22 hours 31 min ago
1 day 20 min ago
1 day 14 hours ago
1 day 14 hours ago
1 day 19 hours ago
2 days 2 hours ago
2 days 3 hours ago
2 days 4 hours ago