Tweak mod_userdir Security

[nileshparmar]

mod_userdir Protection:
Apache's mod_userdir allows users to view their sites by entering a tilde(~) and their username as the uri on a specific host. For example http://test.cpanel.net/~fred/ will bring up the user fred's domain. The disadvantage of this feature is that any bandwidth usage used by this site will be put on the domain it is accessed under (in this case test.cpanel.net). mod_userdir protection prevents this from happening. You may however want to disable it on specific virtual hosts (generally shared ssl hosts.)

We have enabled mod_userdir Protection for all our users but some our clients want to view their website via For example http://test.cpanel.net/~fred/

in this section there is mentioned that You may however want to disable it on specific virtual hosts (generally shared ssl hosts.)

but when i select a domain which i want to disable mod_userdir Protection & then ticked marked on Exclude Protection check box then i have restarted apache web server but still i am unable to view selected domain via IP based

now please tell what i m doing wrong ??

Please see attachment for further clarification

[Spiral]

Allowing userdir access is not the greatest of ideas for a lot of reasons ...

Something you might want to consider is setting up a subdomain alias
in the Apache configuration for the accounts that need to access their
sites before their domain DNS propagates, etc

In example:

Instead of http://www.yourdomain.com/~username,
it would be http://username.yourdomain.com/

Setting up something like this can be done fairly easily to be added
automatically to new accounts upon creation with wildcard DNS and
a few virtualhost template adjustments or just manually updating
if you only have a few hosts.

If you think this is something that would interest you, I'll post more
details about exactly how to set this up.

PS: The exclude you were talking about in your post excludes the site from protection
but not from being about to be viewed by ~username

[nileshparmar]

It doesn't considered to subdomain aliases

mod_userdir Protection: means, clients cannot view their website via IP based for example http://11.11.111.11/~test

we have enable mod_userdir Protection for all our users but some clients wants to view their website via http://11.11.111.11/~test

what changes can be done this