Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file:

<VirtualHost *:80>
        ServerName foobar.com
        ServerAlias www.foobar.com
        ServerAdmin webmaster@foobar.com
        DocumentRoot /path/to/websites/foobar/web
        DirectoryIndex index.php

        # CustomLog with format nickname
        LogFormat "%h %l %u %t \"%r\" %>s %b" common
        CustomLog "|/usr/bin/cronolog /var/log/apache2/%Y%m.foobar.access.log" common

        LogLevel notice
        ErrorLog "|/usr/bin/cronolog /var/log/apache2/%Y%m.foobar.errors.log"

        <Directory />
                AllowOverride None
                Order Deny,Allow
                Deny from all
        </Directory>

        <Directory /path/to/websites/>
                Options -Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>
</VirtualHost>

I am able to access the website by using www.foobar.com, however when I type foobar.com, I get the error 'Server not found' - why is this?

My second question concerns the security implications of the directive:

<Directory /path/to/websites/>
        Options -Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
</Directory>

in the configuration above. What exactly is it doing, and is it necessary?. From my (admitedly limited) understanding of Apache configuration files, this means that anyone will be able to access (write to?) the /path/to/websites/ folder. Is my understanding correct? - and if yes, how is this not a security risk?

share|improve this question
    
Two questions are better (here) in... well, two separate questions –  Lazy Badger Mar 28 '12 at 14:12
add comment

1 Answer 1

In order to work with two names under one site you have

  • Respond from Apache side on both Host request (you done it)
  • Configure DNS for domain in order to
    • have 2 URLs
    • route to the correct host

In short: nslookup foobar.com and nslookup www.foobar.com must return answers and answers to be identical

Your impression about <Directory> container directive is wrong. Any host can reach this URL and get content. Zero suppositions and judgments about the possibility of writing. Maybe you start reading Apache docs before asking questions?!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.