Apache config for blocking php exploit requests that is compatible with Rails under Passenger

rubyonrails-talk
1

Hi,

I was just looking at my logs and noticed a decent amount of 404s as a result of requests trying to use php exploits. I don't use PHP on my host at all, so I figure it's time to uniformly deny php requests with Apache to save my Rails apps having to look up the route.

My searching has mostly brought back how tos on redirecting TO php rather than block it.

I did find a mention of mod_security which looks promising. I'm wondering if it is compatible with Passenger. Any success or horror stories for it? Configuration file you would be willing to share?

What else do people recommend?

Cheers, Walter

2

Hi,

I was just looking at my logs and noticed a decent amount of 404s as a result of requests trying to use php exploits. I don't use PHP on my host at all, so I figure it's time to uniformly deny php requests with Apache to save my Rails apps having to look up the route.

My searching has mostly brought back how tos on redirecting TO php rather than block it.

At a very simple level something like

RewriteRule \.php$ - [F]

Would rewrite any request where the url ended in .php to 403s

Fred

3

At a very simple level something like

RewriteRule \.php$ - [F]

Would rewrite any request where the url ended in .php to 403s

Tried it. I have Passenger in high performance mode and it looks to disable mod_rewrite.

http://www.modrails.com/documentation/Users%20guide%20Apache.html#PassengerHighPerformance

I may be out of luck if I want to keep that set to on.

Cheers, Walter

4

> At a very simple level something like

> RewriteRule \.php$ - [F]

> Would rewrite any request where the url ended in .php to 403s

Tried it. I have Passenger in high performance mode and it looks to disable mod_rewrite.

Phusion Passenger users guide, Apache version…

I may be out of luck if I want to keep that set to on.

Well if you really do need it, the docs say that you can turn it on for only certain paths, so you could just activate it for your most highly trafficked pages and leave the remainder with mod_rewrite enabled.

Fred

5

Yes, I read that. It's a trade-off and for now I would rather keep the high performance on for the virtual host. Not a big deal really, but was hoping for a non-rewrite solution (FilesMatch also doesn't look to work with PassengerHighPerformance).

Always good to check though.

Thanks for your input.

Cheers, Walter