LinkBack URL
About LinkBacksWhats the general consent regarding AllowOverride ?
As one of the scripter from fantastico tryes to tell me that "AllowOverride ALL" in httpd.conf is not a security risk .
Risk factor high, allows .htaccess over ride
Risk factor low , doesnt seem to matter to much to most hosters
Risk factor none ; no problem with that at all
Risk ? Who cares 
AllowOverride Risk Factor
Whats the general consent regarding AllowOverride ?
As one of the scripter from fantastico tryes to tell me that "AllowOverride ALL" in httpd.conf is not a security risk .
Last edited by gorilla; 03-21-2006 at 03:05 AM.
or am i just beeing simply paranoid ?
It's a security risk if it allows end-users to do things you don't want them to as part of your security model. Best practice is to allow only what you want to happen, rather than leaving the door open and inviting burgulars in. There's some interesting thoughts about AllowOverride here:
http://www.onlamp.com/pub/a/apache/2...pacheckbk.html
Jonathan Michaelson
Need your cPanel servers secured and tuned?
cPanel Server Configuration, Security, Recovery and Antivirus/AntiSpam Services
Developers of the most effective (and free) Firewall & Security Solution for cPanel Servers - csf
http://www.configserver.com
Reply With Quote