cPanel Forums

gorilla · #1 (**permalink**) 03-21-2006, 03:00 AM

Whats the general consent regarding AllowOverride ?
As one of the scripter from fantastico tryes to tell me that "AllowOverride ALL" in httpd.conf is not a security risk .

gorilla · #2 (**permalink**) 03-21-2006, 09:40 AM

or am i just beeing simply paranoid ?

chirpy · #3 (**permalink**) 03-22-2006, 11:30 AM

It's a security risk if it allows end-users to do things you don't want them to as part of your security model. Best practice is to allow only what you want to happen, rather than leaving the door open and inviting burgulars in. There's some interesting thoughts about AllowOverride here:
http://www.onlamp.com/pub/a/apache/2...pacheckbk.html

View Poll Results: AllowOverride risk factor
Risk factor high, allows .htaccess over ride	3	42.86%
Risk factor low , doesnt seem to matter to much to most hosters	2	28.57%
Risk factor none ; no problem with that at all	2	28.57%
Risk ? Who cares	0	0%
Voters: 7. You may not vote on this poll

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode