Sorry to put in here, but is there away for me to test to see if my server
is affected by this OPTIONS issue? I have cPanel / WHM and ConfigServer
Firewall installed and just about every day, I see CSF blocking users from
trying to hack in using some known hacking kit. Something with the word
w00t in it and blackhat. I'd just like to make sure I got all exploitable
services closed. Thanks!
On Thu, Feb 11, 2016 at 6:50 PM, Yann Ylavic <ylavic....@gmail.com> wrote:
> Hello,
>
> On Thu, Feb 11, 2016 at 10:56 PM, Toomas Aas <toomas....@reach-u.com>
> wrote:
> >
> > Approach 1:
> > -------------------------------------
> > RewriteCond %{REQUEST_METHOD} OPTIONS
> > RewriteRule .* - [R=405,L]
> > -------------------------------------
>
> You also need to set:
> RewriteOptions AllowAnyURI
> for this to work.
>
> But since this option could open some dangerous doors (see [1]), I
> also suggest to use something like:
> RewriteRule ^[^/] - [R=403,L]
> just after "Approach 1" above, so to deny any URI not starting with '/'.
>
> Regards,
> Yann.
>
> [1] http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html#rewriteoptions
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
> For additional commands, e-mail: users-h...@httpd.apache.org
>
>
