# $HeadURL$ # $Id$ ################################################################## # wiki.dept.school.edu ################################################################## UseCanonicalName off ServerName wiki.dept.school.edu ServerAdmin deoren.moor@cv.edu ServerAlias wiki DocumentRoot /var/www/dept.school.edu/twiki # If visitor is not using SSL redirect them. Redirect / https://wiki.dept.school.edu:445/ # Mod_perl preloading (required in Apache SRV directive scope, see below) # http://perl.apache.org/docs/2.0/user/config/config.html#mod_perl_Directives_Argument_Types_and_Allowed_Location Perlrequire /var/www/dept.school.edu/twiki/tools/mod_perl_startup.pl PerlSwitches -T ServerName twiki.dept.school.edu ServerAdmin deoren.moor@cv.edu ServerAlias twiki DocumentRoot /var/www/dept.school.edu/twiki # Enable SSL for this vhost SSLEngine on # Path to certificate and key SSLCertificateFile conf/ssl/wiki_server.crt SSLCertificateKeyFile conf/ssl/wiki_server.key # allow all ciphers for the initial handshake, # so export browsers can upgrade via SGC facility ... SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL Order allow,deny Allow from all SSLOptions +StrictRequire # REQUIRE SSL for connections to material in this directory SSLRequireSSL # ... but finally deny all browsers which haven't upgraded SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 # This block will be used when I'm upgrading and do not want everyone else # to have access. # # Order Deny,Allow # Allow from 192.168.1.131 # Admin desktop # Deny from all # # ErrorDocument 403 "Upgrade in progress. Call for details" # # # Autogenerated httpd.conf file for TWiki. # Generated at http://twiki.org/cgi-bin/view/TWiki/ApacheConfigGenerator # We set an environment variable called blockAccess. # # Setting a BrowserMatchNoCase to ^$ is important. It prevents TWiki from # including its own topics as URLs and also prevents other TWikis from # doing the same. This is important to prevent the most obvious # Denial of Service attacks. # # You can expand this by adding more BrowserMatchNoCase statements to # block evil browser agents trying the impossible task of mirroring a twiki # # Example: # BrowserMatchNoCase ^SiteSucker blockAccess # BrowserMatchNoCase ^$ blockAccess BrowserMatchNoCase ^Accoona blockAccess BrowserMatchNoCase ^ActiveAgent blockAccess BrowserMatchNoCase ^Attache blockAccess BrowserMatchNoCase BecomeBot blockAccess BrowserMatchNoCase ^bot blockAccess BrowserMatchNoCase Charlotte/ blockAccess BrowserMatchNoCase ^ConveraCrawler blockAccess BrowserMatchNoCase ^CrownPeak-HttpAgent blockAccess BrowserMatchNoCase ^EmailCollector blockAccess BrowserMatchNoCase ^EmailSiphon blockAccess BrowserMatchNoCase ^e-SocietyRobot blockAccess BrowserMatchNoCase ^Exabot blockAccess BrowserMatchNoCase ^FAST blockAccess BrowserMatchNoCase ^FDM blockAccess BrowserMatchNoCase ^GetRight/6.0a blockAccess BrowserMatchNoCase ^GetWebPics blockAccess BrowserMatchNoCase ^Gigabot blockAccess BrowserMatchNoCase ^gonzo1 blockAccess BrowserMatchNoCase ^Google\sSpider blockAccess BrowserMatchNoCase ^ichiro blockAccess BrowserMatchNoCase ^ie_crawler blockAccess BrowserMatchNoCase ^iGetter blockAccess BrowserMatchNoCase ^IRLbot blockAccess BrowserMatchNoCase Jakarta blockAccess BrowserMatchNoCase ^Java blockAccess BrowserMatchNoCase ^KrakSpider blockAccess BrowserMatchNoCase ^larbin blockAccess BrowserMatchNoCase ^LeechGet blockAccess BrowserMatchNoCase ^LinkWalker blockAccess BrowserMatchNoCase ^Lsearch blockAccess BrowserMatchNoCase ^Microsoft blockAccess BrowserMatchNoCase ^MJ12bot blockAccess BrowserMatchNoCase MSIECrawler blockAccess BrowserMatchNoCase ^MSRBOT blockAccess BrowserMatchNoCase ^noxtrumbot blockAccess BrowserMatchNoCase ^NutchCVS blockAccess BrowserMatchNoCase ^RealDownload blockAccess BrowserMatchNoCase ^Rome blockAccess BrowserMatchNoCase ^Roverbot blockAccess BrowserMatchNoCase ^schibstedsokbot blockAccess BrowserMatchNoCase ^Seekbot blockAccess BrowserMatchNoCase ^SiteSnagger blockAccess BrowserMatchNoCase ^SiteSucker blockAccess BrowserMatchNoCase ^Snapbot blockAccess BrowserMatchNoCase ^sogou blockAccess BrowserMatchNoCase ^SpiderKU blockAccess BrowserMatchNoCase ^SpiderMan blockAccess BrowserMatchNoCase ^Squid blockAccess BrowserMatchNoCase ^Teleport blockAccess BrowserMatchNoCase ^User-Agent\: blockAccess BrowserMatchNoCase VoilaBot blockAccess BrowserMatchNoCase ^voyager blockAccess BrowserMatchNoCase ^W3C blockAccess BrowserMatchNoCase ^w3search blockAccess BrowserMatchNoCase ^Web\sDownloader blockAccess BrowserMatchNoCase ^WebCopier blockAccess BrowserMatchNoCase ^WebDevil blockAccess BrowserMatchNoCase ^WebSec blockAccess BrowserMatchNoCase ^WebVac blockAccess BrowserMatchNoCase ^Webwhacker blockAccess BrowserMatchNoCase ^Webzip blockAccess BrowserMatchNoCase ^Wells blockAccess BrowserMatchNoCase ^WhoWhere blockAccess BrowserMatchNoCase www\.netforex\.org blockAccess BrowserMatchNoCase ^WX_mail blockAccess BrowserMatchNoCase ^yacybot blockAccess BrowserMatchNoCase ^ZIBB blockAccess BrowserMatchNoCase ^$ blockAccess # The ScriptAlias defines the bin directory as a directory where CGI # scripts are allowed. # The first parameter will be part of the URL to your installation e.g. # http://my.co.uk/twiki/bin/view/... # The second parameter must point to the physical path on your disc. ScriptAlias /twiki/bin "/var/www/dept.school.edu/twiki/bin" # The Alias defines a url that points to the root of the twiki installation. # It is used to access files in the pub directory (attachments etc) # It must come _after_ the ScriptAlias. Alias /twiki "/var/www/dept.school.edu/twiki" # This specifies the options on the TWiki scripts directory. The ExecCGI # and SetHandler tell apache that it contains scripts. "Allow from all" # lets any IP address access this URL. AllowOverride All Order Allow,Deny Allow from all Deny from env=blockAccess Options ExecCGI FollowSymLinks SetHandler cgi-script # File to return on access control error (e.g. wrong password) # By convention this is the TWikiRegistration page, that allows users # to register with the TWiki. Apache requires this to be a *local* path. ErrorDocument 401 /twiki/bin/view/TWiki/TWikiRegistration # Limit access to configure to specific IP addresses and or users. # Make sure configure is not open to the general public. # It exposes system details that can help attackers. SetHandler cgi-script Order Deny,Allow Deny from all Allow from 192.168.1.131 # Enable mod_perl for the bin scripts listed SetHandler perl-script PerlResponseHandler ModPerl::Registry PerlSendHeader On PerlOptions +ParseHeaders # This sets the options on the pub directory, which contains attachments and # other files like CSS stylesheets and icons. AllowOverride None stops a # user installing a .htaccess file that overrides these options. # Note that files in pub are *not* protected by TWiki Access Controls, # so if you want to control access to files attached to topics you need to # block access to the specific directories same way as the ApacheConfigGenerator # blocks access to the pub directory of the Trash web Options None AllowOverride None Order Allow,Deny Allow from all Deny from env=blockAccess # Disable execution of PHP scripts php_admin_flag engine off # This line will redefine the mime type for the most common types of scripts # It will also deliver HTML files as if they are text files AddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi .sh # Security note: All other directories should be set so # that they are *not* visible as URLs, so we set them as =deny from all=. deny from all deny from all deny from all deny from all deny from all