Help with apache httpd

[Ikith]

I'm doing a project for my apache httpd class and we are doing SSI (server side includes) and he wants this:

"Use apache configuration directives to turn off the ability for SSIs to display this sensitive information. The background Includes should still work, however."

I have tried finding something like this in the documentation but I have found nothing about this.

For reference this is the whole assignment just in case it depends on context:

Create a new apache site.

Put an index file in every document directory and subdirectory.

Use a single graphic background file in all .html and .shtml files in this site, use Server Side Includes (SSI) to put the graphic in all pages.

Configure the site to not index and not serve all .htaccess files.

Make two subdirectories and use .htaccess to implement password security for both. Both directories should use the same realm name.

Make user and group auth files: make a user called supervisor, put this user in no group file. Make a user called person. Put the person user in a group file called happy.

The Document Root index file should have links to both sub-directories.


In Document Sub-Directory one



The security for this directory should allow access to an account named supervisor.

Create an index that points to five .shtml files in this directory. The index should describe what each .shtml file does. All these files will use SSIs and all should be permitted to work by enabling includes.

File One should display the current apache error log contents

File Two should display the current apache transfer log contents

File Three should display the current httpd.conf file contents

File Four should display the contents of /etc/passwd

File Five should display the current processes running on the system.


In Document Sub-Directory two



The security for this directory should allow access to members of a group named "happy".

Copy the same index file and five .shtml files from the previous directory into this directory. Modify the index file to indicate that this is a different directory. Use apache configuration directives to turn off the ability for SSIs to display this sensitive information. The background Includes should still work, however.

I haven't implemented the authentication part of the project but it shouldn't interfere with the rest of the project.

Anyone have any ideas?

[Skjie]

I'm a little rusty, but I believe you should be able to create a different config without +includes in httpd.conf for that directory. Otherwise, I'd try something like Options -Includes in the .htaccess for that directory, but that's probably not what your prof is looking for.

[isladar]

Moved to Tech.

[Ikith]

Figured it out it was:

Options +IncludesNOEXEC

[Teorem]

Figured it out it was:

Options +IncludesNOEXEC

Looking at the assignment, I'm pretty sure this is the wrong answer, actually. This option prevents "exec" SSIs from being handled by the server process, which would cause your "File Five" to fail, when in fact the problem explicitly indicates that it should still work properly.

Look at the documentation again. There are ways to limit access to files using configuration directives, just like the problem asks you to.