Frames Modems Help Home Page Chipsets Search No Frames
Diary Entries See also Site Info & Diary.
6 October 2001 Hiding include files (see also 5 Oct) using the htaccess server file...
  As many include files will contain sensitive info I don't want them to be directly accessible via browser. Access Control in Apache is effected globally via the httpd.conf file plus on a directory-by-directory basis via a .htaccess file present in the directory.

(1 Mar Thanks to Brian at UK Linux for confirming that the htaccess file is available to webmasters on the server & for a link to a site giving simple info on use of this file. The Apache manual offers this link also. Incidentally, the .htaccess file is not itself visible via FTP once uploaded.)

I certainly can't affect the global options on my chosen ISP since I don't own the Server. However - as long as UK Linux have authorised .htaccess files - I can affect access to files on my own webspace using the .htaccess file. Another way of keeping these files from the webserver is detailed in Section 69 of the PHP article, but this has the same problem as the httpd.conf file.

This does mean, of course, that once on the system it cannot be viewed by myself, either. Attempted access gives a 404 error.

 
  1. The .htaccess file which worked on my system:
      #  ---  .htaccess  ---
      # Access control info for Apache
      
      # Examine the global http.conf (server configuration) file:
      #  "AccessFileName" specifies the name of this file
      #  "AllowOverride" needs to give control to this file
      #
      # This file affects only the directory in which it is placed
      
      # First, access is denied to any file that begins ".ht"
      # (httpd.conf normally contains this, but this command makes sure)
      <Files ~ "^\.ht">
        Order allow,deny
        Deny from all
      </Files>
      
      # Next, all access is denied to PHP include files (by filetype)
      # eg anything.abc or anything.xyz
      <Files ~ "\.(abc|xyz)$">
        Order allow,deny
        Deny from all
      </Files>
      
      # Hiding these files in server-generated directory listings.
      # (the last item is normally already hidden globally)
      <IfModule mod_autoindex.c>
        IndexIgnore *.abc *.xyz .??*
      </IfModule>